237689916fec2b9ae86da1308b4e35bed5048e426c70bd953668e37e2e078e85 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 08:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

OX163/gzip.dll
Size

31KB
MD5

14511fb1a09470f3f69af283f3aabba6
SHA1

b978b329cb7fb6595905a06556891b96115f0d60
SHA256

cf77fd51fd1f3c9b00f512b96ef8a1ac32d752ae104e26aa992cecaba1fbea8a
SHA512

84ed05968e3bd263e7b8cca30eba39ce9e317d9875cf02f6efdc38edcf6389ca22d8732fe840709b1526a788da93bec52ece13ecb4324d34f4ab35be8800a827
SSDEEP

768:f85aMgmgho09BpZgbepJy3Y01U9+lrstTG:fCngh/5ZgbepJpDmrgTG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	2632	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2632	2848	rundll32.exe	28
PID 2848 wrote to memory of 2632	2848	rundll32.exe	28
PID 2848 wrote to memory of 2632	2848	rundll32.exe	28
PID 2848 wrote to memory of 2632	2848	rundll32.exe	28
PID 2848 wrote to memory of 2632	2848	rundll32.exe	28
PID 2848 wrote to memory of 2632	2848	rundll32.exe	28
PID 2848 wrote to memory of 2632	2848	rundll32.exe	28
PID 2632 wrote to memory of 1720	2632	rundll32.exe	29
PID 2632 wrote to memory of 1720	2632	rundll32.exe	29
PID 2632 wrote to memory of 1720	2632	rundll32.exe	29
PID 2632 wrote to memory of 1720	2632	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\OX163\gzip.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\OX163\gzip.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 228
    3⤵
    - Program crash
    PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads