397ff48f9ae2034c72bb9428427fbf6eca8df5b215723ba31094cf323f32df5e

Analysis

max time kernel
93s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 05:58

Target

$APPDATA/Hotspot Shield/report/zlib1.dll
Size

73KB
MD5

c7d4d685a0af2a09cbc21cb474358595
SHA1

b784599c82bb90d5267fd70aaa42acc0c614b5d2
SHA256

e96b397b499d9eaa3f52eaf496ca8941e80c0ad1544879ccadf02bf2c6a1ecfc
SHA512

fed2c126a499fae6215e0ef7d76aeec45b60417ed11c7732379d1e92c87e27355fe8753efed86af4f58d52ea695494ef674538192fac1e8a2a114467061a108b
SSDEEP

1536:+4nToIf2W/nkQRZHaamLQHoIOah7Vryh7IO4cZlIXw6Epb:bTBfHdRZH9mLQHuaBVGn4FXw6E1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3244	1780	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 1780	4564	rundll32.exe	84
PID 4564 wrote to memory of 1780	4564	rundll32.exe	84
PID 4564 wrote to memory of 1780	4564	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\Hotspot Shield\report\zlib1.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\Hotspot Shield\report\zlib1.dll",#1
  2⤵
  PID:1780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 600
    3⤵
    - Program crash
    PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1780 -ip 1780
1⤵
PID:3000

memory/1780-0-0x0000000061B80000-0x0000000061B98000-memory.dmp

Filesize
96KB

Download