2b9e2bdeb348be368e9cafd06c15414bbe725af32a8c40ee56c3266db8a5b2a3

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 17:46

Target

Debug/bin/zstd.dll
Size

638KB
MD5

5b96fb0d4e6453680da278f5b7e51a29
SHA1

3c96a29248fa3644de2c653a5d97c1e21b13a769
SHA256

1374391dafd6262795243a58f9fb234be859d940683fe756c64692ca807f0478
SHA512

27d06b7182aa48a81cce18f8f7b1bee054f3a862ccebd77d273a67c6a15e5d0ef5ba8fd7430976f445eb8bff51d290f2bb50061ac7ef448255ba8a18b8baf193
SSDEEP

6144:fbauYl+rrR8uT4uB5uWYfO16oMynnjDHMkYHbpk5tRCEybNFZemMBLx4uQ16aSG:fbauYGT5BYMxjDHMk0petRCEyb9emHO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2128	2772	rundll32.exe	30
PID 2772 wrote to memory of 2128	2772	rundll32.exe	30
PID 2772 wrote to memory of 2128	2772	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\bin\zstd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2772 -s 80
  2⤵
  PID:2128