ef483723ac88d655dfc5f08537cbc7ca6bef3ca2c2f34fd1ade321156f4efe08

Analysis

max time kernel
1555s
max time network
1557s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 13:52

Target

ZRK 1.1 UC/src/PyQt5/Qt5/bin/Qt5WebSockets.dll
Size

145KB
MD5

a016545f963548e0f37885e07ef945c7
SHA1

cbe499e53ab0bd2da21018f4e2092e33560c846f
SHA256

6b56f77da6f17880a42d2f9d2ec8b426248f7ab2196a0f55d37ade39e3878bc6
SHA512

47a3c965593b97392f8995c7b80394e5368d735d4c77f610afd61367ffe7658a0e83a0dbd19962c4fa864d94f245a9185a915010afa23467f999c833982654c2
SSDEEP

3072:4sSkET6pEXb3loojg1Q2sorWvZXF2sorrLA7cG27Qhvvc:4sSd6pwzloDbsnX0sCrc7ct7QVc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1352	1624	rundll32.exe	31
PID 1624 wrote to memory of 1352	1624	rundll32.exe	31
PID 1624 wrote to memory of 1352	1624	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ZRK 1.1 UC\src\PyQt5\Qt5\bin\Qt5WebSockets.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1624 -s 224
  2⤵
  PID:1352