d75ecbed0a0bfea3a71dde0aed0958e5d98e2890d520532a09a4e5321d7d680a | Triage

Analysis

max time kernel
1614s
max time network
1618s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
07-07-2023 07:29

Sharing

Report Analysis Logs

General

Target

zlib1.dll
Size

73KB
MD5

05bf83777d5b6c7bf74a512f51f34a7b
SHA1

5c177218220a9c1df6eff2fc46bf3dd512986222
SHA256

0d2a785476bf5ab1906f4738e92df18a2c438e27225c1c1cac9afe77417c0b46
SHA512

0249ac76f843b3d46120da665ebe3b361f120477997f3809b88188d1afeffa2a789f5a990930441f54729d1e806c2ce005893ac77a88dd87d302e2ee49eba941
SSDEEP

1536:iD5gPaCVRn77BGHXrfD0zelgdRH/KNn6BnToIfhIOsIOEmhfgh:Q59+R7t+szelgdRfKNcTBfLiEmhfgh

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

784 2324 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2280 wrote to memory of 2324	2280	rundll32.exe	rundll32.exe
PID 2280 wrote to memory of 2324	2280	rundll32.exe	rundll32.exe
PID 2280 wrote to memory of 2324	2280	rundll32.exe	rundll32.exe
PID 2280 wrote to memory of 2324	2280	rundll32.exe	rundll32.exe
PID 2280 wrote to memory of 2324	2280	rundll32.exe	rundll32.exe
PID 2280 wrote to memory of 2324	2280	rundll32.exe	rundll32.exe
PID 2280 wrote to memory of 2324	2280	rundll32.exe	rundll32.exe
PID 2324 wrote to memory of 784	2324	rundll32.exe	WerFault.exe
PID 2324 wrote to memory of 784	2324	rundll32.exe	WerFault.exe
PID 2324 wrote to memory of 784	2324	rundll32.exe	WerFault.exe
PID 2324 wrote to memory of 784	2324	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2280

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib1.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 224
3⤵
- Program crash
PID:784

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...