9ccb0bc19f24b694a4129cc387279457e57671f8109937550258ffc40173423b | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04-08-2024 17:36

Sharing

Report Analysis Logs

General

Target

zlibwapi.dll
Size

87KB
MD5

dd91e4c7d445c31682ebdd22e732d93d
SHA1

2ed9d1a085fa9179d199e0372d81462816fd7504
SHA256

1f047faec08d9a35c304fb4a7cf13853589359a8f7cbfdd48c5d5807712dcf05
SHA512

0e610c0b97a970ed6077e27f8071f32cceef6410133b9ee8934849443b8ebfb022f1d88f9b7bff77f3b5a243c73b5a4e05fae843bdbc849ba09168ecb61d5f87
SSDEEP

1536:3d34luTY6/aYPBqxRjt3JRSVoIOFIORnToIfHyRXCWdd:3hIuBZKjtZMuP5TBfqX/d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2724 wrote to memory of 2700	2724	rundll32.exe	WerFault.exe
PID 2724 wrote to memory of 2700	2724	rundll32.exe	WerFault.exe
PID 2724 wrote to memory of 2700	2724	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlibwapi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2724 -s 80
  2⤵
  PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads