c1411695a46008567ed81c474298a6cade2e743d50019acb46407ed66cb11b0e

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-02-2025 09:58

Target

zlib1.dll
Size

91KB
MD5

8715690438860eaecc98cdd95aa80ab8
SHA1

92cf890392febc1c53a7417870cbc9ac373c7405
SHA256

42566cadd56feb726be5544bf5552aa8d4009b415906a2e7ae7945212b16cfb8
SHA512

989ce0028c0002842f1e7671076fa5ce6a1bdb7b364d008c04cbba5cfe1abbaab20051e284cfc351e46c85d2816e9b1b214ad2bf642839a6df84de1c7c544249
SSDEEP

1536:5/EC1lUVwGnWFS2C1LlImUILLjPeCU1WxfBp1nToIfGIOMIOtrP9jCCGFI:5/EC1Kmzsr1LlHUaHPeSflTBfkCtrPNT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2264	2500	rundll32.exe	30
PID 2500 wrote to memory of 2264	2500	rundll32.exe	30
PID 2500 wrote to memory of 2264	2500	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2500 -s 80
  2⤵
  PID:2264

memory/2500-0-0x0000000062E80000-0x0000000062E9F000-memory.dmp

Filesize
124KB

Download