cc2dcc5d8ca7223ffb3319943591ef4d917d83e75c2cdfaa23ae240f72bb4264 | Triage

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 00:37

Sharing

Report Analysis Logs

General

Target

Loader/zlib1.dll
Size

85KB
MD5

6b2cfe74852195fb8187f368b74f7635
SHA1

e23e54714355b852726e81a17c444059e0d1339c
SHA256

be93482393ca7d2b440d5559d86268758dadf2f13899978e0271ab1db06b8091
SHA512

6f3ffb5baf6d89ecd76fbdd949327ad12bcfc25b973dc81df498033e3dd65e4bb9774d696e4059abd336dff3cb219ed5a36d38e2e0f63dae2db22c96c359ccd6
SSDEEP

1536:kTHRfzojvOeiRMPrpbAE1ApOal2qk0MGmnToIfUIOcIOYGW3wY:UBzojvOeiRMTtAEepOT0PSTBf6SYfwY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2456	2292	rundll32.exe	30
PID 2292 wrote to memory of 2456	2292	rundll32.exe	30
PID 2292 wrote to memory of 2456	2292	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Loader\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2292 -s 84
  2⤵
  PID:2456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads