8eb6945907c07f04bcfd3d70dde85c2c6adafad1f5a11008df67882a5220f767

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 09:43

Target

__MACOS__/__MACOS__/__MACOS__/__MACOS__/__MACOS__/zlibwapi.dll
Size

1.6MB
MD5

6ec11ede3d071077bb96b8e092010c12
SHA1

6fe0fc0b550795ee71172e7ea66e48795ce76bc2
SHA256

b069555dc7aa3dc7c32c9181af73f595fb34cda0032348bff36c35f32934e915
SHA512

84670845acd849579d63346ad0f43f7dc791bf78856aac243ba82b2ed11adc9335284b5dc8f1b0bd4d9b364d0af07e95f7272cdcd791103bfb8cc4f6673bcd13
SSDEEP

12288:ePONV1AoxWr6Nk3GQyY0LjHWZYzpOqJAFaed5S1NUXdR/Fx1MJl96shjngXkZtnO:ePfoxdjaNaqzI9t9+hpw8cZ2F

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 1812	2348	rundll32.exe	30
PID 2348 wrote to memory of 1812	2348	rundll32.exe	30
PID 2348 wrote to memory of 1812	2348	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\__MACOS__\__MACOS__\__MACOS__\__MACOS__\__MACOS__\zlibwapi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2348 -s 108
  2⤵
  PID:1812