4b60b2960da8862d8ddb07ca1a96302bc591110dc1898a0bc6495e4fbacd56ad

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
03-11-2024 19:43

Target

Avernus/Avernus/bin/zstd.dll
Size

638KB
MD5

fcbc4271f6b949ebe5fc7f02c7732378
SHA1

81bdcf7fc286bedd3cb9575fa97673752f53e3e5
SHA256

115a2e56238e05299e65111b8361b8de3324f188d172129ca4fc641b56ad0a7e
SHA512

c2c416cf41b76530c301d12be62ef490d45d260b1a1aa1e7be3512215f3ffbce88792e70bb159f4982947a1a8fbf4df38c2e7119a8a124ccfeeab6d2a2bf95f8
SSDEEP

6144:/qd76u2e8QuAkx7OT5evcME1Tk82zXtrwXgOTmkriCiaNFcuU2JmR/RXusb:i4u2IuAWcMEgzXt8QCmZCiaAuUn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2732	2128	rundll32.exe	30
PID 2128 wrote to memory of 2732	2128	rundll32.exe	30
PID 2128 wrote to memory of 2732	2128	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Avernus\Avernus\bin\zstd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2128 -s 84
  2⤵
  PID:2732