178d950e74dce8c1728c3b64614b775710f2dbdd72777358c5ceee81af0586f0

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 02:54

Target

Lowkey Cracked_ BYKali/zlib1.dll
Size

85KB
MD5

6b2cfe74852195fb8187f368b74f7635
SHA1

e23e54714355b852726e81a17c444059e0d1339c
SHA256

be93482393ca7d2b440d5559d86268758dadf2f13899978e0271ab1db06b8091
SHA512

6f3ffb5baf6d89ecd76fbdd949327ad12bcfc25b973dc81df498033e3dd65e4bb9774d696e4059abd336dff3cb219ed5a36d38e2e0f63dae2db22c96c359ccd6
SSDEEP

1536:kTHRfzojvOeiRMPrpbAE1ApOal2qk0MGmnToIfUIOcIOYGW3wY:UBzojvOeiRMTtAEepOT0PSTBf6SYfwY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2856 wrote to memory of 2912	2856	rundll32.exe	WerFault.exe
PID 2856 wrote to memory of 2912	2856	rundll32.exe	WerFault.exe
PID 2856 wrote to memory of 2912	2856	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Lowkey Cracked_ BYKali\zlib1.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2856

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2856 -s 80
2⤵
PID:2912