e5a4f00a5050fd2f029b4bacba9fc79c65e8f74809ee53eda02e2059352811d7 | Triage

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 00:59

Sharing

Report Analysis Logs

General

Target

cygz.dll
Size

51KB
MD5

25c24a77ab99d96fc7648b24a27d4037
SHA1

a01b673abedc1694cf5d16aa70a65307af9f228d
SHA256

d3e5cc3e0361010d06a070a7840a153068f2aaeded373e85f32cae0740eb0723
SHA512

c4f24dbaa60d91a249786c6dee2d03dcd083210e52fbf3ec2a1fb78e97b01eb4406dd652d1b31a12f4985ffbf3a349c219441dab8d80a637a2048fc713355e7b
SSDEEP

768:AwpkwsCo8vkjvoK36c4+DBP2H0gYjHYpK9m5uCbWWspApwKqNE7a90S+WoxPb:1PVoI6o86c4CyevyHIApwM70f+9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3836	5044	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 5044	3420	rundll32.exe	85
PID 3420 wrote to memory of 5044	3420	rundll32.exe	85
PID 3420 wrote to memory of 5044	3420	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cygz.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cygz.dll,#1
  2⤵
  PID:5044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 600
    3⤵
    - Program crash
    PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5044 -ip 5044
1⤵
PID:2384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5044-0-0x0000000067FC0000-0x0000000067FD2000-memory.dmp

Filesize
72KB

Download