4313d352e0dafd1f22b6517126a655cae3b444fa758d2845eddfbe72f24f7bdd | Triage

Analysis

max time kernel
93s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 08:05

Sharing

Report Analysis Logs

General

Target

Bin/zlib1.dll
Size

80KB
MD5

9a96baab5658196a84eae814a3a0156d
SHA1

6cf5d9cf95106dc416aa926e81ca12d88596ac01
SHA256

c78eab41b346598736be1196eb949660b710356ad83204f6ef5bf9585c94731e
SHA512

e4f6d0d7dc347360cccd783b47330852691a423db7ffedcd488aa4bb291ebe1ab1391433b679f6310d3fb03196f37da2100e4be9f50e823f04b4d3fecace53a6
SSDEEP

1536:ugD4bH9j/gc+r8mINuqbCXuFNx6nToIfGIOlIO3XP3R:ugD6jupqbJLgTBfkv3f3R

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	4244	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4244	5036	rundll32.exe	83
PID 5036 wrote to memory of 4244	5036	rundll32.exe	83
PID 5036 wrote to memory of 4244	5036	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bin\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bin\zlib1.dll,#1
  2⤵
  PID:4244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 600
    3⤵
    - Program crash
    PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4244 -ip 4244
1⤵
PID:4520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads