5bb2af4f0e70623e1ce277a4cd0c0c27e51890541e34f0e9a1e5b81ce4a12324 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2024 20:42

Sharing

Report Analysis Logs

General

Target

quazip.dll
Size

76KB
MD5

5c9805adc9fdfd7d58f4d1146378f55b
SHA1

6f0110c5157c782f27f0759c4c614381bf53ba83
SHA256

ec29ea2f9f00ca1acea603f2997fd936e81ef3689f53b3d428e3a92c2a421f32
SHA512

3a11645d5fe805c750f335f8c8adcb82200ef6be73d124348fb51957bed1cee87d177b59335215d9f508544320b84f7b704a0ae600eddc44a13f82abea6d204e
SSDEEP

1536:Y9tXBRkCJaLKz8kl0hTTRXTnIImfb1ASOfJ4D9SjF3:Y9TREB1TXLIPfb1ASOfJ3J

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4948	3708	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 552 wrote to memory of 3708	552	rundll32.exe	87
PID 552 wrote to memory of 3708	552	rundll32.exe	87
PID 552 wrote to memory of 3708	552	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\quazip.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\quazip.dll,#1
  2⤵
  PID:3708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 648
    3⤵
    - Program crash
    PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3708 -ip 3708
1⤵
PID:4900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads