0bbf49dd0df354467d21b219a536d845f62a71ae891dbef7510708f97f82dfc8 | Triage

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/ZipDLL.dll
Size

156KB
MD5

c1f57bec4bdf89b89f194a967a401b64
SHA1

133a70d59e8eac012e82e94139deb11a1d686834
SHA256

9600ed5d104cec286929c88ccfd3bf2fcf0f96c022123599dbd58832529e7523
SHA512

47dfe32d1a20cb23c5cdf73616cd10cd5e9262b587e0019ce2c93a21a396a78e16b38e80c946d1a279266c8cfa0217f951d9e497cc63a6f290ff3f2cde04f3f1
SSDEEP

3072:naPI8mgZKC+I3GRnOJ4XWWnFRp4iZ/7MX6leb8+knzo7DoM:naPI8HEc2MyWURdZ/uAeb5TDx

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1516	3244	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 3244	652	rundll32.exe	81
PID 652 wrote to memory of 3244	652	rundll32.exe	81
PID 652 wrote to memory of 3244	652	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ZipDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ZipDLL.dll,#1
  2⤵
  PID:3244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 600
    3⤵
    - Program crash
    PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3244 -ip 3244
1⤵
PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads