5dde351516155c3ec5f77c4b93018609d6beeb642a03f12d5da30f0e1ca9d410 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 06:46

Sharing

Report Analysis Logs

General

Target

LiteZip.dll
Size

39KB
MD5

6b0a2f1a4894ea98ae291c4c7157258c
SHA1

eb84113974e5a9f407d7bae2acc83a9d6b3f7c99
SHA256

4df5f1b5f6068347c9e0dccdfc07c4c8103fb798f3b3ea31c3b8c53cb384a9ca
SHA512

f32719a62fd7cadd95618405f201f930ad48002fc65c23245456989ad4dd798a16e301777dff229b72dc58a74b81b74acd79ce4364c3dfdad10172b3c0df804c
SSDEEP

768:oy41BN8y3eMQ7kaXYeluJGa2vhZUBgAf9rY1Ve8R0jr5:oy4vqWThel+Gh63f2Ve1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2468	376	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 376	2248	rundll32.exe	30
PID 2248 wrote to memory of 376	2248	rundll32.exe	30
PID 2248 wrote to memory of 376	2248	rundll32.exe	30
PID 2248 wrote to memory of 376	2248	rundll32.exe	30
PID 2248 wrote to memory of 376	2248	rundll32.exe	30
PID 2248 wrote to memory of 376	2248	rundll32.exe	30
PID 2248 wrote to memory of 376	2248	rundll32.exe	30
PID 376 wrote to memory of 2468	376	rundll32.exe	31
PID 376 wrote to memory of 2468	376	rundll32.exe	31
PID 376 wrote to memory of 2468	376	rundll32.exe	31
PID 376 wrote to memory of 2468	376	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LiteZip.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LiteZip.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 224
    3⤵
    - Program crash
    PID:2468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads