7bdb19204fec2ec0addc3761372caef85894bacf999c6c2fe80c64eef3abd936

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
16/12/2024, 23:42

Target
Makala Executor/bin/zstd.dll
Size 638KB
Sample241216-3p82datmfw
SHA256 1374391dafd6262795243a58f9fb234be859d940683fe756c64692ca807f0478
MD5 5b96fb0d4e6453680da278f5b7e51a29
SHA1 3c96a29248fa3644de2c653a5d97c1e21b13a769
SHA512 27d06b7182aa48a81cce18f8f7b1bee054f3a862ccebd77d273a67c6a15e5d0ef5ba8fd7430976f445eb8bff51d290f2bb50061ac7ef448255ba8a18b8baf193
SSDEEP 6144:fbauYl+rrR8uT4uB5uWYfO16oMynnjDHMkYHbpk5tRCEybNFZemMBLx4uQ16aSG:fbauYGT5BYMxjDHMk0petRCEyb9emHO
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2776	2500	rundll32.exe	30
PID 2500 wrote to memory of 2776	2500	rundll32.exe	30
PID 2500 wrote to memory of 2776	2500	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Makala Executor\bin\zstd.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2500 -s 84
  2⤵
  PID:2776