88cad3952c02dc2a6857ba73205d440d1326c051e7075bfb69a3429cb1f0a061

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 02:30

Target

bin/download/zlib1.dll
Size

58KB
MD5

89f6488524eaa3e5a66c5f34f3b92405
SHA1

330f9f6da03ae96dfa77dd92aae9a294ead9c7f7
SHA256

bd29d2b1f930e4b660adf71606d1b9634188b7160a704a8d140cadafb46e1e56
SHA512

cfe72872c89c055d59d4de07a3a14cd84a7e0a12f166e018748b9674045b694793b6a08863e791be4f9095a34471fd6abe76828dc8c653be8c66923a5802b31e
SSDEEP

1536:ZfU1BgfZqvECHUhUMPZVmnToIfxIOjIOG8TI:ZfzfZR2UhUMPZVSTBfbFG6I

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	2052	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2052	2084	rundll32.exe	28
PID 2084 wrote to memory of 2052	2084	rundll32.exe	28
PID 2084 wrote to memory of 2052	2084	rundll32.exe	28
PID 2084 wrote to memory of 2052	2084	rundll32.exe	28
PID 2084 wrote to memory of 2052	2084	rundll32.exe	28
PID 2084 wrote to memory of 2052	2084	rundll32.exe	28
PID 2084 wrote to memory of 2052	2084	rundll32.exe	28
PID 2052 wrote to memory of 1736	2052	rundll32.exe	29
PID 2052 wrote to memory of 1736	2052	rundll32.exe	29
PID 2052 wrote to memory of 1736	2052	rundll32.exe	29
PID 2052 wrote to memory of 1736	2052	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\download\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\download\zlib1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 224
    3⤵
    - Program crash
    PID:1736