34e141c88f20dffe25bf118a427415ce55cbc123848a2f6d2d5ccfe390a746ec | Triage

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 10:17

Sharing

Report Analysis Logs

General

Target

Wave/CrackedWave/bin/zlib1.dll
Size

87KB
MD5

f6fc96cfccdd9958a157546faa4c13a9
SHA1

ae8e4171a0583a761ae4428e5757daeedaf2a157
SHA256

231e29c228652e9d6504e608a1cc53311e762cd4c78deb7c9ef11bc27f13d3da
SHA512

fb983083b5c620616d2547a7903f8ebfd2ad52ed9bdde8264b6e555fb47644c488779d3ade52f5e601dbc31e67f40ea973f41f45af242790dc5d8a91c163c8dc
SSDEEP

1536:Q7wjHHWwn1rhEzjEp70E2thqlz4bqIOcIOZFkGnd02H:QcjH2w1EjEpIq6b4SZFfndjH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2224	2184	rundll32.exe	30
PID 2184 wrote to memory of 2224	2184	rundll32.exe	30
PID 2184 wrote to memory of 2224	2184	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Wave\CrackedWave\bin\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2184 -s 80
  2⤵
  PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads