7bdb19204fec2ec0addc3761372caef85894bacf999c6c2fe80c64eef3abd936

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 23:27

Target

Makala Executor/bin/zstd.dll
Size

638KB
MD5

5b96fb0d4e6453680da278f5b7e51a29
SHA1

3c96a29248fa3644de2c653a5d97c1e21b13a769
SHA256

1374391dafd6262795243a58f9fb234be859d940683fe756c64692ca807f0478
SHA512

27d06b7182aa48a81cce18f8f7b1bee054f3a862ccebd77d273a67c6a15e5d0ef5ba8fd7430976f445eb8bff51d290f2bb50061ac7ef448255ba8a18b8baf193
SSDEEP

6144:fbauYl+rrR8uT4uB5uWYfO16oMynnjDHMkYHbpk5tRCEybNFZemMBLx4uQ16aSG:fbauYGT5BYMxjDHMk0petRCEyb9emHO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2556	2564	rundll32.exe	31
PID 2564 wrote to memory of 2556	2564	rundll32.exe	31
PID 2564 wrote to memory of 2556	2564	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Makala Executor\bin\zstd.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2564 -s 84
  2⤵
  PID:2556