6a359aea078faa3feaeddc2e508184994950d74a65ce4ff0330792383c78c473 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
28/06/2022, 00:57

Sharing

Report Analysis Logs

General

Target

n3zarek.dll
Size

1.4MB
MD5

b41810bbc67d20adb256a0d30674c881
SHA1

e332e30611b36bbda3ffa98dbdf57590dab5b932
SHA256

924eb7c79148a8dc9cd66ace2702788c172a82ca8744b3283bd030ec0414e80b
SHA512

8a43bfbaa05b4dc1949b7030236ff249d54ead3b50c8ce24960d52f7b13a5903b4c764f59c453f2249ebaddcf65459c9a92b3b7f81304e9506ad5a239b274735

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	1864	WerFault.exe	24

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 1728	1864	rundll32.exe	28
PID 1864 wrote to memory of 1728	1864	rundll32.exe	28
PID 1864 wrote to memory of 1728	1864	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\n3zarek.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1864 -s 84
  2⤵
  - Program crash
  PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads