486b1ff53fb896c08eb98df156d8e36a1c88285ee109c7f27adc0c41ef0762ea

Resubmissions

19/11/2024, 13:13

19/11/2024, 13:11

max time kernel
11s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 13:13

Target

CRIMSON/Bin/zstd.dll
Size

638KB
MD5

5b96fb0d4e6453680da278f5b7e51a29
SHA1

3c96a29248fa3644de2c653a5d97c1e21b13a769
SHA256

1374391dafd6262795243a58f9fb234be859d940683fe756c64692ca807f0478
SHA512

27d06b7182aa48a81cce18f8f7b1bee054f3a862ccebd77d273a67c6a15e5d0ef5ba8fd7430976f445eb8bff51d290f2bb50061ac7ef448255ba8a18b8baf193
SSDEEP

6144:fbauYl+rrR8uT4uB5uWYfO16oMynnjDHMkYHbpk5tRCEybNFZemMBLx4uQ16aSG:fbauYGT5BYMxjDHMk0petRCEyb9emHO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 1824	2600	rundll32.exe	29
PID 2600 wrote to memory of 1824	2600	rundll32.exe	29
PID 2600 wrote to memory of 1824	2600	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CRIMSON\Bin\zstd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2600 -s 84
  2⤵
  PID:1824