180b585699602924e45e46c6ba98ce91964d37f8e10e9859ec14542ecb45762a | Triage

Analysis

max time kernel
1563s
max time network
1565s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 16:27

Sharing

Report Analysis Logs

General

Target

zlibwapi.dll
Size

87KB
MD5

dd91e4c7d445c31682ebdd22e732d93d
SHA1

2ed9d1a085fa9179d199e0372d81462816fd7504
SHA256

1f047faec08d9a35c304fb4a7cf13853589359a8f7cbfdd48c5d5807712dcf05
SHA512

0e610c0b97a970ed6077e27f8071f32cceef6410133b9ee8934849443b8ebfb022f1d88f9b7bff77f3b5a243c73b5a4e05fae843bdbc849ba09168ecb61d5f87
SSDEEP

1536:3d34luTY6/aYPBqxRjt3JRSVoIOFIORnToIfHyRXCWdd:3hIuBZKjtZMuP5TBfqX/d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3024	2936	rundll32.exe	28
PID 2936 wrote to memory of 3024	2936	rundll32.exe	28
PID 2936 wrote to memory of 3024	2936	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlibwapi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2936 -s 80
  2⤵
  PID:3024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads