ac574eaf659c27c5b06ebe1cc4c125665c7219e1255f8e0ba7bbc61d5046b25c | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
04/01/2025, 21:38

Sharing

Report Analysis Logs

General

Target

Nexus-Roblox/zlib1.dll
Size

117KB
MD5

66a3477a51e8b7d4586edf4659cde8d5
SHA1

3306c6aca3937d8bca11dd076effb03746367b9f
SHA256

cb7ab3788d10940df874acd97b1821bbb5ee4a91f3eec11982bb5bf7a3c96443
SHA512

948ba42499bba17b552723c3189289e9f07879c9303ec6f27b4d631b7d701c16fe66fc8c6a681236cef778b0cb0a14420493e048aa90bba682606ce2990c64ab
SSDEEP

3072:djf8ECbYiB317HVhVpaKdAAcsrK2M2nuh2UI6vTH2F3I:xLCbYiBp1LghAxG9BI6LH2F3I

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1604	1996	rundll32.exe	30
PID 1996 wrote to memory of 1604	1996	rundll32.exe	30
PID 1996 wrote to memory of 1604	1996	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Nexus-Roblox\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1996 -s 84
  2⤵
  PID:1604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-0-0x000007FEF7C50000-0x000007FEF7C74000-memory.dmp

Filesize
144KB

Download