2c73333d01cf79c1a643e0e152dbfe90cfddadac7d0dcb41beaf0db455968adf | Triage

Analysis

max time kernel
60s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12-03-2023 16:17

Sharing

Report Analysis Logs

General

Target

zlib1.dll
Size

109KB
MD5

45a5816b9dc733f231b3351e4e0f88ae
SHA1

f8b91d7a962a4ae50fe6bfaa1b1e8a2b1c636790
SHA256

1e47fc6c6ec13f0fa0935d8c994c69e34cdb7ea3fda5bac864ba195c2a175ad4
SHA512

fcac13e9c51581f7bd719791d6c6c88709e4af8a46df4144e054ef4dab9bb9adefdca9756e112c5e575443fba4dae799f79859514ab34d90d96b869ec326df7a
SSDEEP

3072:zLXVVFvf23hwNjm4B2snRwIMYTBf8pQpyvFx4D5:zLvFvf23FlhIMYTBEKpyv7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	1048	WerFault.exe	20

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2016	1048	rundll32.exe	28
PID 1048 wrote to memory of 2016	1048	rundll32.exe	28
PID 1048 wrote to memory of 2016	1048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1048 -s 84
  2⤵
  - Program crash
  PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-54-0x0000000062E80000-0x0000000062EA4000-memory.dmp

Filesize
144KB

Download