ef483723ac88d655dfc5f08537cbc7ca6bef3ca2c2f34fd1ade321156f4efe08

Analysis

max time kernel
1559s
max time network
1560s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 13:52

Target

ZRK 1.1 UC/src/PyQt5/Qt5/bin/Qt5QmlModels.dll
Size

428KB
MD5

2030c4177b499e6118be5b9e5761fce1
SHA1

050d0e67c4aa890c80f46cf615431004f2f4f8fc
SHA256

51e4e5a5e91f78774c44f69b599fae4735277ef2918f7061778615cb5c4f6e81
SHA512

488f7d5d9d8deee9bbb9d63dae346e46efeb62456279f388b323777999b597c2d5aea0ee379bdf94c9cbcfd3367d344fb6b5e90ac40be2ce95efa5bbdd363bcc
SSDEEP

6144:k1tE6lq982HdyuEZ5gw+VHDZjZ0yOWm7Vdcm4GyasLCZCu6vdQp:k1tEuq9Hdyuo5gwguyOtVIup

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2904	2844	rundll32.exe	30
PID 2844 wrote to memory of 2904	2844	rundll32.exe	30
PID 2844 wrote to memory of 2904	2844	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ZRK 1.1 UC\src\PyQt5\Qt5\bin\Qt5QmlModels.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2844 -s 224
  2⤵
  PID:2904