8e0e38ed2f8c46569c0b1d250f3e66b190d256a7fa0824bd5d3e8bf215fb5ce2 | Triage

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 22:24

Sharing

Report Analysis Logs

General

Target

rxbaoV3.29_Y/zlibwapi.dll
Size

138KB
MD5

54789344b07bed58e43851eca47e2b12
SHA1

93c561365bc7f1cbb5385d0323ed81044a6ec276
SHA256

9f8729ac49e0ccea86fe3b1a9b2c3fae9986ecd09db92853e7a588dbda85bf90
SHA512

54d4af3de4b12ff8f25a4596cdb97bb32fd739217f99849bdebe5ca92d801cb5564d4407193bcbfaf8118e5d3391543a80ff08371e28c35c2c091d9ff90a3692
SSDEEP

3072:rjdSKCC+FzNehv8Rqiq9+yVojaylvjTBfxvA:rjdS8czEuqFVojzlvjTBJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4340 852 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 428 wrote to memory of 852	428	rundll32.exe	rundll32.exe
PID 428 wrote to memory of 852	428	rundll32.exe	rundll32.exe
PID 428 wrote to memory of 852	428	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\zlibwapi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\zlibwapi.dll,#1
  2⤵
  PID:852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 600
    3⤵
    - Program crash
    PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 852 -ip 852
1⤵
PID:4840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-132-0x0000000000000000-mapping.dmp

Download