0d60601a1157cff3eba748a058ac48b94f25989aa30aba124be9c45877a7e034 | Triage

Analysis

max time kernel
184s
max time network
299s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
24-02-2024 18:29

Sharing

Report Analysis Logs

General

Target

zlib.dll
Size

52KB
MD5

4965107d112666d3835308a831a29274
SHA1

50439b99ce525ecb74c554e1dc43ddb39481dfa4
SHA256

105280995cd5746078d67b8651dfe4ad2abcd532d7ad528d3100c535b0b538af
SHA512

38fa8f0eeadd75bf212eaab458833cfd3445d00f3d77f1f8a86b7c3ba99376231c8b3fc3cfdff6f02f2ca9c90956c76f9055717712d35a7ca7b30172a0010b59
SSDEEP

768:MX8TJyuiie4tVkIuCE8U8tOF5GqqQhGbY5ma78ct+Jn0r25mSSIjpe5uw+/Bz4o1:MXGJxIIuCE8U8tOF5pUB0wEo+X

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
596	3088	WerFault.exe	75

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 3088	212	rundll32.exe	75
PID 212 wrote to memory of 3088	212	rundll32.exe	75
PID 212 wrote to memory of 3088	212	rundll32.exe	75

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib.dll,#1
  2⤵
  PID:3088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 624
    3⤵
    - Program crash
    PID:596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3088-0-0x0000000002B80000-0x0000000002BA7000-memory.dmp

Filesize
156KB

Download