31e8dda13e7a2e04829a653f8d30ddea96763b4045c6f9123160539cbf7b1e14

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 11:34

Target

$SYSDIR/360zip/360zipver.dll
Size

16KB
MD5

dec4a4b2d4b8790881efa9b416713fa1
SHA1

df0a91bffec33a05c861cd68c9bbb579a591ea40
SHA256

a26e21d7f32c54e3b99de96c10865cac0c4cde89af58a645c2f191c8b75deb9f
SHA512

0f381c0383f355a2f114bd59ff24fb78e7c103a007d386e96508f8d14430e0dcb4ca7ed812a77ec617220ca343b6647f814b8b4b934e67427cc8ff274741a665
SSDEEP

192:3mHSwxs6dKoq3XKrqsy6cWfyMrj6Pu77rePuXuu+vWr9ZCspE+TMgr4DWDB:3ElstV6g66MCPfGuZeM12

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1700 wrote to memory of 2984	1700	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 2984	1700	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 2984	1700	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 2984	1700	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 2984	1700	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 2984	1700	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 2984	1700	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\360zip\360zipver.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\360zip\360zipver.dll,#1
2⤵
PID:2984