5a4be9e92cf84b6fdedef3623c4fc76a9a239e98f88c0c4368bbb72caafdda03 | Triage

Analysis

max time kernel
145s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-02-2024 11:47

Sharing

Report Analysis Logs

General

Target

libbz2-1.dll
Size

72KB
MD5

48d3f1f67f43425584f04e1a082b3b7d
SHA1

246b8a0b9f8823ff9b801e083c060a090df8c784
SHA256

cb5df7c5577839996278a88b92b1e944feebb846e9eaa8c0742183d668c161de
SHA512

4b1775f4d6fa10dc33b728fde3a3053e360617ddc67b0629a85a6e49b8704608a95da1faa3def7961f5f17a4e75a079cd836ff2c1afbf8f554c5fadc75633425
SSDEEP

768:cxFBplHJfeJuf0hk9b8B6rei9+ko5mLV2LOGN23Ag3Qb/A023x:YjlNe8f0G9ogrei1M18DwMx

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2208	2240	rundll32.exe	28
PID 2240 wrote to memory of 2208	2240	rundll32.exe	28
PID 2240 wrote to memory of 2208	2240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libbz2-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2240 -s 84
  2⤵
  PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2240-0-0x00000000626C0000-0x00000000626DA000-memory.dmp

Filesize
104KB

Download