7bc23223c8f81d70c230ceac3deb05670e9778974fd285b8cae1e693c2367de4

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 12:15

Target

DontBearWithCheaters/zstd.dll
Size

638KB
MD5

a3ee06ae6058525909f3d956d298718d
SHA1

32f0788f36428dfa8f565f3884bd739d83f44f89
SHA256

cdccb1bf7fea582cc2d15a355e31d3b068418b097cebe3074ba61d3603fa6d27
SHA512

db891643bdbd676d77350143f1217d98e2e7ec4501b29be00634edce44eda49639ee663de86553abe02dccd4b4d0c53a1a9a9dfb7bf2e918367202ec598b388f
SSDEEP

6144:1qd76u2e8QuAkx7OT5evcME1Tk82zXtrwXgOTmkriCiaNFcuU2JmR/kXsXuQND9:04u2IuAWcMEgzXt8QCmZCiaAuUn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2380	1940	rundll32.exe	30
PID 1940 wrote to memory of 2380	1940	rundll32.exe	30
PID 1940 wrote to memory of 2380	1940	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DontBearWithCheaters\zstd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1940 -s 80
  2⤵
  PID:2380