6f8b540361c734dd1b08c829483cc31674ad5dd38909e6e9692bc95f2dfaf24e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 18:16

Target

KanKan/zlib.dll
Size

52KB
MD5

4965107d112666d3835308a831a29274
SHA1

50439b99ce525ecb74c554e1dc43ddb39481dfa4
SHA256

105280995cd5746078d67b8651dfe4ad2abcd532d7ad528d3100c535b0b538af
SHA512

38fa8f0eeadd75bf212eaab458833cfd3445d00f3d77f1f8a86b7c3ba99376231c8b3fc3cfdff6f02f2ca9c90956c76f9055717712d35a7ca7b30172a0010b59
SSDEEP

768:MX8TJyuiie4tVkIuCE8U8tOF5GqqQhGbY5ma78ct+Jn0r25mSSIjpe5uw+/Bz4o1:MXGJxIIuCE8U8tOF5pUB0wEo+X

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	1240	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 2200 wrote to memory of 1240	2200	rundll32.exe	28
PID 1240 wrote to memory of 1980	1240	rundll32.exe	29
PID 1240 wrote to memory of 1980	1240	rundll32.exe	29
PID 1240 wrote to memory of 1980	1240	rundll32.exe	29
PID 1240 wrote to memory of 1980	1240	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KanKan\zlib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KanKan\zlib.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 224
    3⤵
    - Program crash
    PID:1980