ef483723ac88d655dfc5f08537cbc7ca6bef3ca2c2f34fd1ade321156f4efe08

Analysis

max time kernel
1556s
max time network
1559s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 13:52

Target

ZRK 1.1 UC/src/PyQt5/Qt5/bin/Qt5Svg.dll
Size

322KB
MD5

03761f923e52a7269a6e3a7452f6be93
SHA1

2ce53c424336bcc8047e10fa79ce9bce14059c50
SHA256

7348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5
SHA512

de0ff8ebffc62af279e239722e6eedd0b46bc213e21d0a687572bfb92ae1a1e4219322233224ca8b7211ffef52d26cb9fe171d175d2390e3b3e6710bbda010cb
SSDEEP

6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2708 wrote to memory of 2868	2708	rundll32.exe	31
PID 2708 wrote to memory of 2868	2708	rundll32.exe	31
PID 2708 wrote to memory of 2868	2708	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ZRK 1.1 UC\src\PyQt5\Qt5\bin\Qt5Svg.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2708 -s 216
  2⤵
  PID:2868

memory/2708-0-0x000007FEF5CC0000-0x000007FEF6201000-memory.dmp

Filesize
5.3MB

Download