b9dc0bb16ff8f763ddf28513308c4b5fb89795e3afb36bc8aca2d41e408b55f4 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 04:17

Sharing

Report Analysis Logs

General

Target

UsbEAm Hosts Editor-v3.63/gzip.dll
Size

29KB
MD5

8b3591965f623b219c0c528153746cab
SHA1

020961494fa0e08779b7aacf4422269935354f7d
SHA256

97ea3d99cf21123bc1aec72f9ded6a51ac659830392adfefd424eb799ab0219e
SHA512

6e547197d160c9ec13cf2384add1bb6753276e3dab97d951adba9257d6bf999720635a7b9d94a5ca8b94bdda2f25f36c5938d126bc3e46a358e1fad072132351
SSDEEP

768:T5aM3xJoa/eBmLnw7w4/Y5C81G1ky6lHA6St:d5Joa/eIH4/Y55JvHAh

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2060	2316	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2316	2264	rundll32.exe	17
PID 2264 wrote to memory of 2316	2264	rundll32.exe	17
PID 2264 wrote to memory of 2316	2264	rundll32.exe	17
PID 2264 wrote to memory of 2316	2264	rundll32.exe	17
PID 2264 wrote to memory of 2316	2264	rundll32.exe	17
PID 2264 wrote to memory of 2316	2264	rundll32.exe	17
PID 2264 wrote to memory of 2316	2264	rundll32.exe	17
PID 2316 wrote to memory of 2060	2316	rundll32.exe	16
PID 2316 wrote to memory of 2060	2316	rundll32.exe	16
PID 2316 wrote to memory of 2060	2316	rundll32.exe	16
PID 2316 wrote to memory of 2060	2316	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\UsbEAm Hosts Editor-v3.63\gzip.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\UsbEAm Hosts Editor-v3.63\gzip.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 224
1⤵
- Program crash
PID:2060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads