29081253537f8c90e40915430d712693ceb7cc941718f53395708067e142a041 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-01-2025 00:11

Sharing

Report Analysis Logs

General

Target

zlib1.dll
Size

141KB
MD5

b4a0b3d5abc631e95c074eee44e73f96
SHA1

c22c8baa23d731a0e08757d0449ca3dd662fd9e6
SHA256

c89c8a2fcf11d8191c7690027055431906aae827fc7f443f0908ad062e7e653e
SHA512

56bafd1c6c77343f724a8430a1f496b4a3160faa9a19ea40796438ae67d6c45f8a13224dcf3d1defb97140a2e47a248dd837801a8cb4674e7890b495aeec538e
SSDEEP

3072:jqLKjJj3yg1shVjm4OvfqnKAh2mrohmR5JHDbu4cCxp/:jqGEgSefI3roCDbH/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2288	2112	rundll32.exe	30
PID 2112 wrote to memory of 2288	2112	rundll32.exe	30
PID 2112 wrote to memory of 2288	2112	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2112 -s 80
  2⤵
  PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2112-0-0x000007FEF74E0000-0x000007FEF750A000-memory.dmp

Filesize
168KB

Download