ef483723ac88d655dfc5f08537cbc7ca6bef3ca2c2f34fd1ade321156f4efe08

Analysis

max time kernel
1556s
max time network
1558s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 13:52

Target

ZRK 1.1 UC/src/PyQt5/Qt5/bin/Qt5Widgets.dll
Size

5.2MB
MD5

4cd1f8fdcd617932db131c3688845ea8
SHA1

b090ed884b07d2d98747141aefd25590b8b254f9
SHA256

3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
SHA512

7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199
SSDEEP

49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2668 wrote to memory of 2684	2668	rundll32.exe	30
PID 2668 wrote to memory of 2684	2668	rundll32.exe	30
PID 2668 wrote to memory of 2684	2668	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ZRK 1.1 UC\src\PyQt5\Qt5\bin\Qt5Widgets.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2668 -s 216
  2⤵
  PID:2684

memory/2668-0-0x000007FEF5D70000-0x000007FEF62B1000-memory.dmp

Filesize
5.3MB

Download