e68d23feaf21b116b0bdeb7c667f8fb547a58f53437dd9e3f9141b5afc6dddcd | Triage

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 15:07

Sharing

Report Analysis Logs

General

Target

sfbrename-cli-1.0.0-win64/zlib1.dll
Size

116KB
MD5

66cd727fb33126b1c03b174aa1e6735a
SHA1

bb742318c4fdaf6f3d8bf41c5936813e976e6e15
SHA256

a26b41bb482967b170453c93edf8f108052ab00f0c7d1134761f625c085f175e
SHA512

5e755926b48a04682a42261bba4d1721a1d9d2b86f4bacf058c5f2ffbf3c539507cd98f7ec5d7def1c7324c14ccdef8e06cde5df9736cffe14b83c6709109c65
SSDEEP

3072:rYDRFWocTjWRHcJSpPCh5IAAzh24DfQn2F36:k1AocH5KarIZ5DfQn2F36

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2832	2784	rundll32.exe	30
PID 2784 wrote to memory of 2832	2784	rundll32.exe	30
PID 2784 wrote to memory of 2832	2784	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sfbrename-cli-1.0.0-win64\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2784 -s 80
  2⤵
  PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2784-0-0x000007FEF71F0000-0x000007FEF7214000-memory.dmp

Filesize
144KB

Download