6d7a257e34261f8c88e355658881a50a056f8600e2e57ac0b24647a35143e1d2

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 01:35

Target

__MACOS__/__MACOS__/__MACOS__/__MACOS__/__MACOS__/zlibwapi.dll
Size

1.6MB
MD5

7e8c8fef5c71b9a1d3df82506bffcb36
SHA1

5217af85b027700a28c18b3aa8ae09af95ad7bc0
SHA256

b6862257dd7faa0769d3b6a7a6b74fc513c4df39a949ca0b9491731b1fa1df01
SHA512

c601ced157ef41537173fa8566d5e15ba3416301a945e0eeb72ae740d855a38d4df66afa823ea5f017a1ac8c2a4b1fc1442341bacc03abf63a489999d0933040
SSDEEP

24576:tYMdnojBpPQ1SKzzepDd1W5nDTV/QTG1riqfXLIF:/nKpJKzzMWB5YCmq0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 1376	2604	rundll32.exe	30
PID 2604 wrote to memory of 1376	2604	rundll32.exe	30
PID 2604 wrote to memory of 1376	2604	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\__MACOS__\__MACOS__\__MACOS__\__MACOS__\__MACOS__\zlibwapi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2604 -s 108
  2⤵
  PID:1376