5dde351516155c3ec5f77c4b93018609d6beeb642a03f12d5da30f0e1ca9d410 | Triage

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 06:46

Sharing

Report Analysis Logs

General

Target

LiteZip.dll
Size

39KB
MD5

6b0a2f1a4894ea98ae291c4c7157258c
SHA1

eb84113974e5a9f407d7bae2acc83a9d6b3f7c99
SHA256

4df5f1b5f6068347c9e0dccdfc07c4c8103fb798f3b3ea31c3b8c53cb384a9ca
SHA512

f32719a62fd7cadd95618405f201f930ad48002fc65c23245456989ad4dd798a16e301777dff229b72dc58a74b81b74acd79ce4364c3dfdad10172b3c0df804c
SSDEEP

768:oy41BN8y3eMQ7kaXYeluJGa2vhZUBgAf9rY1Ve8R0jr5:oy4vqWThel+Gh63f2Ve1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1644	100	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 100	2512	rundll32.exe	85
PID 2512 wrote to memory of 100	2512	rundll32.exe	85
PID 2512 wrote to memory of 100	2512	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LiteZip.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LiteZip.dll,#1
  2⤵
  PID:100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 600
    3⤵
    - Program crash
    PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 100 -ip 100
1⤵
PID:4148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads