e11811db10afadc6d917402d841b750dc66b91649657a5020adc81cd5d84a72c

Analysis

max time kernel
1562s
max time network
1567s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 21:17

Target

bin/zstd.dll
Size

638KB
MD5

5b96fb0d4e6453680da278f5b7e51a29
SHA1

3c96a29248fa3644de2c653a5d97c1e21b13a769
SHA256

1374391dafd6262795243a58f9fb234be859d940683fe756c64692ca807f0478
SHA512

27d06b7182aa48a81cce18f8f7b1bee054f3a862ccebd77d273a67c6a15e5d0ef5ba8fd7430976f445eb8bff51d290f2bb50061ac7ef448255ba8a18b8baf193
SSDEEP

6144:fbauYl+rrR8uT4uB5uWYfO16oMynnjDHMkYHbpk5tRCEybNFZemMBLx4uQ16aSG:fbauYGT5BYMxjDHMk0petRCEyb9emHO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2876	1580	rundll32.exe	30
PID 1580 wrote to memory of 2876	1580	rundll32.exe	30
PID 1580 wrote to memory of 2876	1580	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\zstd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1580 -s 84
  2⤵
  PID:2876