7bc23223c8f81d70c230ceac3deb05670e9778974fd285b8cae1e693c2367de4

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 12:15

Target
DontBearWithCheaters/zlib1.dll
Size 88KB
Sample240818-pfbgvswekr
SHA256 fdf95f94e604db0c8c23777fa3ca4dba84b8541074feeadd0d64be15b5f0e9ff
MD5 e62e2a6c41a71792abf106543d20dd77
SHA1 f78d717115c894486ceada000a2199deb36c571a
SHA512 d8042ececb6ff99264f2973c721367ad2bc81855a7e2278e532ef69be6709cfec86a132d0dd7d4ba8e3f2c544b990b8622032858ecc9f66f2f9a3a03bae1e3d2
SSDEEP 1536:9XrCl5V5lEwda1RnSbFfbpYwayRyivl9LlKIOcIOZ7yfXEEUnvfzG0Tgre:dcV5lEwUbShbpbaCpv9YSZ7wXEEUnnz3
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1160	2136	rundll32.exe	30
PID 2136 wrote to memory of 1160	2136	rundll32.exe	30
PID 2136 wrote to memory of 1160	2136	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DontBearWithCheaters\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2136 -s 80
  2⤵
  PID:1160