4324fb787a2cf92fddcc9e8bb97f299539d991b86b2e3ef618141e56278ee424 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

GZIP.dll
Size

19KB
MD5

d06d3ed9ad9b3a9bc644ffe4729a03cd
SHA1

d58aa41517ca8765365ec498ab3be79a2a7bab80
SHA256

c875f8b2db2a1c89ee76d6f2e4431be63d728e8d7edc2635df2d3ce1b9f8cb73
SHA512

124c8d2f09026a8f64e5b3822b3c40a6282c93f914d15f8902bb76775ff0d59d4e395fdd79673865f3739562c6fa7ed23d1fa5dad6969954768188013e689fcb
SSDEEP

384:JMTnIZMZlfoMfrPhyza/Ig3AEjctMQWxoy5XbkLWX:YtfoMjPhyzaDAe9QReXbz

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/1620-0-0x0000000068CD0000-0x0000000068CDF000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4628	1620	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1620	1424	rundll32.exe	79
PID 1424 wrote to memory of 1620	1424	rundll32.exe	79
PID 1424 wrote to memory of 1620	1424	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GZIP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GZIP.dll,#1
  2⤵
  PID:1620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 600
    3⤵
    - Program crash
    PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1620 -ip 1620
1⤵
PID:4860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-0-0x0000000068CD0000-0x0000000068CDF000-memory.dmp

Filesize
60KB

Download