747e7d0915d7860e3e37c26f0c9932249b7446412c0bcf68c9d54784a8b836f9 | Triage

Analysis

max time kernel
10s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-08-2024 01:25

Sharing

Report Analysis Logs

General

Target

zlib1.dll
Size

87KB
MD5

05865c829948d063201327e8d89e20eb
SHA1

88d252b494a71d8a63de45f800d570ab63bdd73c
SHA256

a961f2e27053882c8f4a40a7fd148bcb83df6e75af62fe8e7c9ffc350882f577
SHA512

e3ba06c68375426b6452c725f23c7a7d30ed32dad068eafac57ec37f2ca0d97ee5fe287cd1ba9299af046e21f7ea3fb928c70170ba6979fad40ceeee035f68c7
SSDEEP

1536:c7wjHHWwn1rhEzjEp70E2thqlz42qIOcIOZBzelMPyw:ccjH2w1EjEpIqK24SZNCMPyw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2028	2160	rundll32.exe	30
PID 2160 wrote to memory of 2028	2160	rundll32.exe	30
PID 2160 wrote to memory of 2028	2160	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2160 -s 84
  2⤵
  PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads