6f8b540361c734dd1b08c829483cc31674ad5dd38909e6e9692bc95f2dfaf24e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 18:16

Target

KanKan/zlib.dll
Size

52KB
MD5

4965107d112666d3835308a831a29274
SHA1

50439b99ce525ecb74c554e1dc43ddb39481dfa4
SHA256

105280995cd5746078d67b8651dfe4ad2abcd532d7ad528d3100c535b0b538af
SHA512

38fa8f0eeadd75bf212eaab458833cfd3445d00f3d77f1f8a86b7c3ba99376231c8b3fc3cfdff6f02f2ca9c90956c76f9055717712d35a7ca7b30172a0010b59
SSDEEP

768:MX8TJyuiie4tVkIuCE8U8tOF5GqqQhGbY5ma78ct+Jn0r25mSSIjpe5uw+/Bz4o1:MXGJxIIuCE8U8tOF5pUB0wEo+X

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2804	3468	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 3468	3588	rundll32.exe	84
PID 3588 wrote to memory of 3468	3588	rundll32.exe	84
PID 3588 wrote to memory of 3468	3588	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KanKan\zlib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KanKan\zlib.dll,#1
  2⤵
  PID:3468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 604
    3⤵
    - Program crash
    PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3468 -ip 3468
1⤵
PID:4732

memory/3468-0-0x0000000001170000-0x0000000001197000-memory.dmp

Filesize
156KB

Download