0bb7e3c0492d977fe3b32844b0bccec70a808c2f7a2e36ab0942ed8101d54783 | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 05:11

Sharing

Report Analysis Logs

General

Target

zlib.dll
Size

52KB
MD5

baf50241f7c97d5bce3371b9d45816c5
SHA1

757b029a1d65c89406cffbbc80b43c026482eaf7
SHA256

07148db288df8b8315cc9e874471c202fce59d0f1118f44e284d4bf722252776
SHA512

2f848729a2c841e85e62396683a2dd8246ad7906d9e5db0e2aa7845d30f285240dd348cf1eab31a6256319a4fe732f1967afbcb8f9127461b71ea3e553a480c1
SSDEEP

768:NRagNniRy7pA2cp+k8AVfgibjlR1L+zwWMyK3y8XuNN6OxPs6:NR6RmpITVfgin1iz91jq8U3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3004 2900 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2872 wrote to memory of 2900	2872	rundll32.exe	rundll32.exe
PID 2872 wrote to memory of 2900	2872	rundll32.exe	rundll32.exe
PID 2872 wrote to memory of 2900	2872	rundll32.exe	rundll32.exe
PID 2872 wrote to memory of 2900	2872	rundll32.exe	rundll32.exe
PID 2872 wrote to memory of 2900	2872	rundll32.exe	rundll32.exe
PID 2872 wrote to memory of 2900	2872	rundll32.exe	rundll32.exe
PID 2872 wrote to memory of 2900	2872	rundll32.exe	rundll32.exe
PID 2900 wrote to memory of 3004	2900	rundll32.exe	WerFault.exe
PID 2900 wrote to memory of 3004	2900	rundll32.exe	WerFault.exe
PID 2900 wrote to memory of 3004	2900	rundll32.exe	WerFault.exe
PID 2900 wrote to memory of 3004	2900	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 228
    3⤵
    - Program crash
    PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads