4824b32e77aaa215c6497d16df9c022feddd5162fc8a3aa67a609150d91b8e92

Analysis

max time kernel
91s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 00:15

Target
HaoZipCom32.dll
Size 217KB
Sample240604-ajw6eaed2w
SHA256 36f6200c90bd2c65da899b1db28b116815f9aa6d131e84ada6dc0b2192af4919
MD5 81e73d4df3c502f36f06af09b4b261e4
SHA1 9195c19e3a868ee99f68dc9a860eddb73786623d
SHA512 adcd8e4c9a3933f0dae26c6081bae3aad229adca1a70dac608f61cc83014514273c77059978492447db54b4578e24ca18da64ad3744d15cd6d29ffa98e6affdf
SSDEEP 3072:R9pi19OWVDnIsYoyzxxVPOq07Apnq3CSe9PexHp+v6dFwGllABCqsMJyVdt:Ri1gWJnIsfyzxxZsA2CDepGaHSBdYF
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4616	2460	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 2460	3232	rundll32.exe	82
PID 3232 wrote to memory of 2460	3232	rundll32.exe	82
PID 3232 wrote to memory of 2460	3232	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HaoZipCom32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HaoZipCom32.dll,#1
  2⤵
  PID:2460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 600
    3⤵
    - Program crash
    PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2460 -ip 2460
1⤵
PID:944