387ae43099fee9234854e9c8ebe1b4ae42c22f5b952446334c6335587899deee

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 16:01

Target

bin/k2epack/WStubs/zlib.exe
Size

21KB
MD5

649f12d5bf384f685643a01d899cb4d8
SHA1

64cf53011de135579f362bec753a9d7029eabae6
SHA256

d729eb2ebca742b6a59ccb16b5465f8c510f7b5d02f82c58b11e74288e8642b0
SHA512

4f3cf534399f7d2b789dcc241208b394fa79ed7a69b42f24d57f2267ac4c2fface6e6bffd2a00fde80a3ec2cc5d0cd31cb5a5394e803847212780279796680bd
SSDEEP

384:Bx4JUFSkEMZJZwct5PgCERzSbYMtv3UPkhlw1WxJ1p/dgFAgqvcZdJk:BO4RrZJZt5oCEhSEMtv0UNpKFfGcdJ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2320	2860	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2320	2860	zlib.exe	28
PID 2860 wrote to memory of 2320	2860	zlib.exe	28
PID 2860 wrote to memory of 2320	2860	zlib.exe	28
PID 2860 wrote to memory of 2320	2860	zlib.exe	28

C:\Users\Admin\AppData\Local\Temp\bin\k2epack\WStubs\zlib.exe
"C:\Users\Admin\AppData\Local\Temp\bin\k2epack\WStubs\zlib.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 408
  2⤵
  - Program crash
  PID:2320

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact