fda6b5f03b8fbcf70b9b336ab9bb42b45b3a66911bdee538f5d074724177ba55 | Triage

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 17:15

Sharing

Report Analysis Logs

General

Target

Wind/zstd.dll
Size

639KB
MD5

91032907f8dc67be99885b0b1169837a
SHA1

63b6cd2442d68907ae64bdf72095ad08f0b4d00e
SHA256

ab04353fdcf07994a048ad4dbec1579436066f047fdd63d36e4e29f4b1dd6a2b
SHA512

83ab14249829f9d98d41363a7a6b5b7be8dfda5f51a017145da7930e42cc9de2ce79a524960d115dc533343b62bfdefdce817d95d0c779687e5ee15f2347856f
SSDEEP

12288:AlNqGONdPaszBp/I3MV4IIdsdVWoRpEn/x:AfazBpw3MV4RdsdVWoRpE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1632	2244	rundll32.exe	30
PID 2244 wrote to memory of 1632	2244	rundll32.exe	30
PID 2244 wrote to memory of 1632	2244	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Wind\zstd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2244 -s 80
  2⤵
  PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads