4824b32e77aaa215c6497d16df9c022feddd5162fc8a3aa67a609150d91b8e92

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 00:15

Target
HaoZipCom.dll
Size 259KB
Sample240604-ajw6eaed2w
SHA256 92fd47c9e3fd1edeba8d0770f755d0b0c0b7ad73caa5b422de2bb756c620280d
MD5 2f877d4b9a548c776307f6097c47f59a
SHA1 57ca0f41f8517ee72252c975453113fad77388bf
SHA512 7c74128e8ef3c21682ff5e46a4f314b1e1c20dcd80db8c2fd8a8a930f9dc0509463b4508d89f9bd839ee6ffe36061abaa0567d29f0fbc90b893b34066a64d7c6
SSDEEP 6144:TrebbwO6NwAn3XFNT2C5aKAKnTCR9rjDYFeoKUgwB1Wrw:/e76SAn3Ggay+rjDw3F
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2832	1996	rundll32.exe	28
PID 1996 wrote to memory of 2832	1996	rundll32.exe	28
PID 1996 wrote to memory of 2832	1996	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HaoZipCom.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1996 -s 108
  2⤵
  PID:2832