8398f9158dd22bfb3d847b38495a2720a73d83df4dc8c332837c97282cf56b98 | Triage

Analysis

max time kernel
115s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 16:42

Sharing

Report Analysis Logs

General

Target

scripts/zAnimPlayer.dll
Size

6KB
MD5

3fe41d9d7d104912ca2d0660825e4ccb
SHA1

cc0790c29d6c7f363a245578e59be1cb5416fc88
SHA256

cb349ffb36ba18289051d8287f8d640e11604eb990ac9317ac811769db281e68
SHA512

07b0ec6cf12b21133c5b268557df304bfb95c026b229c3ce3dfd95d09ad24d53e719302fe5d995758bf3a4f003a3311b8141242c4c9bffc4115a4fc8344234ee
SSDEEP

96:slYmg8QiwVe2pd4dzhNv4zevR66f4uS4J2XQ:saBeMd4/df4oJ2g

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2528	2032	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2032	2160	rundll32.exe	91
PID 2160 wrote to memory of 2032	2160	rundll32.exe	91
PID 2160 wrote to memory of 2032	2160	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scripts\zAnimPlayer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\scripts\zAnimPlayer.dll,#1
  2⤵
  PID:2032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 600
    3⤵
    - Program crash
    PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2032 -ip 2032
1⤵
PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:8
1⤵
PID:3336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads