0bb7e3c0492d977fe3b32844b0bccec70a808c2f7a2e36ab0942ed8101d54783 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 05:11

Sharing

Report Analysis Logs

General

Target

zlib.dll
Size

52KB
MD5

baf50241f7c97d5bce3371b9d45816c5
SHA1

757b029a1d65c89406cffbbc80b43c026482eaf7
SHA256

07148db288df8b8315cc9e874471c202fce59d0f1118f44e284d4bf722252776
SHA512

2f848729a2c841e85e62396683a2dd8246ad7906d9e5db0e2aa7845d30f285240dd348cf1eab31a6256319a4fe732f1967afbcb8f9127461b71ea3e553a480c1
SSDEEP

768:NRagNniRy7pA2cp+k8AVfgibjlR1L+zwWMyK3y8XuNN6OxPs6:NR6RmpITVfgin1iz91jq8U3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3360 4048 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3180 wrote to memory of 4048	3180	rundll32.exe	rundll32.exe
PID 3180 wrote to memory of 4048	3180	rundll32.exe	rundll32.exe
PID 3180 wrote to memory of 4048	3180	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib.dll,#1
  2⤵
  PID:4048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 604
    3⤵
    - Program crash
    PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4048 -ip 4048
1⤵
PID:4224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4048-0-0x00000000008A0000-0x00000000008C7000-memory.dmp

Filesize
156KB

Download