7bbb458e6579df29118174eb65579f6f02773e8ead9e89b65933191796774617 | Triage

Analysis

max time kernel
141s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 16:07

Sharing

Report Analysis Logs

General

Target

zlib1.dll
Size

99KB
MD5

caa9c3b04efe83d93a9e4cac94b8e4a9
SHA1

95499536603ea18daf9be781bd927908d8327ac4
SHA256

249221a372e83580fa03e789714117c709fc1ce55cb7372640895833916b9f04
SHA512

faf16f7941e7a4f8a1caa144b0f845c704d38420e3bf549cb8961089dc380d7b08ebf347934366a2ec9b42c69d32e5ac675d56dbed6ebe029cafc2c23410b3b3
SSDEEP

1536:bON+QZJpRJ1glrdXOW0nTEDIptmwRh4p1nToIf6IOqIOqIF4qY+O:0HpRkXOlsIpkwYdTBfI4qIF4qY+O

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4176 2180 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5068 wrote to memory of 2180	5068	rundll32.exe	rundll32.exe
PID 5068 wrote to memory of 2180	5068	rundll32.exe	rundll32.exe
PID 5068 wrote to memory of 2180	5068	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib1.dll,#1
2⤵
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 600
3⤵
- Program crash
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2180 -ip 2180
1⤵
PID:5084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-0-0x0000000063080000-0x00000000630A0000-memory.dmp

Filesize
128KB

Download