7bc23223c8f81d70c230ceac3deb05670e9778974fd285b8cae1e693c2367de4

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 12:15

Target

DontBearWithCheaters/zlib1.dll
Size

88KB
MD5

e62e2a6c41a71792abf106543d20dd77
SHA1

f78d717115c894486ceada000a2199deb36c571a
SHA256

fdf95f94e604db0c8c23777fa3ca4dba84b8541074feeadd0d64be15b5f0e9ff
SHA512

d8042ececb6ff99264f2973c721367ad2bc81855a7e2278e532ef69be6709cfec86a132d0dd7d4ba8e3f2c544b990b8622032858ecc9f66f2f9a3a03bae1e3d2
SSDEEP

1536:9XrCl5V5lEwda1RnSbFfbpYwayRyivl9LlKIOcIOZ7yfXEEUnvfzG0Tgre:dcV5lEwUbShbpbaCpv9YSZ7wXEEUnnz3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1160	2136	rundll32.exe	30
PID 2136 wrote to memory of 1160	2136	rundll32.exe	30
PID 2136 wrote to memory of 1160	2136	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DontBearWithCheaters\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2136 -s 80
  2⤵
  PID:1160