ef483723ac88d655dfc5f08537cbc7ca6bef3ca2c2f34fd1ade321156f4efe08

Analysis

max time kernel
1439s
max time network
1448s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 13:52

Target

ZRK 1.1 UC/src/PyQt5/Qt5/bin/Qt5Network.dll
Size

1.3MB
MD5

3569693d5bae82854de1d88f86c33184
SHA1

1a6084acfd2aa4d32cedfb7d9023f60eb14e1771
SHA256

4ef341ae9302e793878020f0740b09b0f31cb380408a697f75c69fdbd20fc7a1
SHA512

e5eff4a79e1bdae28a6ca0da116245a9919023560750fc4a087cdcd0ab969c2f0eeec63bbec2cd5222d6824a01dd27d2a8e6684a48202ea733f9bb2fab048b32
SSDEEP

24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2988 wrote to memory of 3000	2988	rundll32.exe	30
PID 2988 wrote to memory of 3000	2988	rundll32.exe	30
PID 2988 wrote to memory of 3000	2988	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ZRK 1.1 UC\src\PyQt5\Qt5\bin\Qt5Network.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2988 -s 228
  2⤵
  PID:3000