7bbb458e6579df29118174eb65579f6f02773e8ead9e89b65933191796774617 | Triage

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 16:07

Sharing

Report Analysis Logs

General

Target

zlib1.dll
Size

99KB
MD5

caa9c3b04efe83d93a9e4cac94b8e4a9
SHA1

95499536603ea18daf9be781bd927908d8327ac4
SHA256

249221a372e83580fa03e789714117c709fc1ce55cb7372640895833916b9f04
SHA512

faf16f7941e7a4f8a1caa144b0f845c704d38420e3bf549cb8961089dc380d7b08ebf347934366a2ec9b42c69d32e5ac675d56dbed6ebe029cafc2c23410b3b3
SSDEEP

1536:bON+QZJpRJ1glrdXOW0nTEDIptmwRh4p1nToIf6IOqIOqIF4qY+O:0HpRkXOlsIpkwYdTBfI4qIF4qY+O

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2392 2384 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1044 wrote to memory of 2384	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2384	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2384	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2384	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2384	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2384	1044	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 2384	1044	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 2392	2384	rundll32.exe	WerFault.exe
PID 2384 wrote to memory of 2392	2384	rundll32.exe	WerFault.exe
PID 2384 wrote to memory of 2392	2384	rundll32.exe	WerFault.exe
PID 2384 wrote to memory of 2392	2384	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib1.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 224
3⤵
- Program crash
PID:2392

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2384-0-0x0000000063080000-0x00000000630A0000-memory.dmp

Filesize
128KB

Download