4e2edd6a08fe4e882ad8b41c7d6f715840c4fc389f4d1c4ecc48b86cc252dce7 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-02-2024 03:43

Sharing

Report Analysis Logs

General

Target

7za.dll
Size

263KB
MD5

3107caecf7ec7a7ce12d05f9c3ab078f
SHA1

b72ac571efde591906771b45bed5b7dc568d7b08
SHA256

bd377ba96ff8d3cbaea98190c8a60f32dc9d64dd44eed9aade05d3a74d935701
SHA512

e5f7bceb39975bc77de3d118ab17aed0f2bd5df12dbbcad5a355c34d71dff883a482b377e4b98622ccc3ba48649ba3330d3bb0bac7f9f2e861d9af0c10d1637e
SSDEEP

6144:ZNnwY0ozR5spzvSrnHefQOWdFQJvUhq36F:ZGY0YR5VrnHefgd6JvUe6F

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2244	1736	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 1736	1136	rundll32.exe	28
PID 1136 wrote to memory of 1736	1136	rundll32.exe	28
PID 1136 wrote to memory of 1736	1136	rundll32.exe	28
PID 1136 wrote to memory of 1736	1136	rundll32.exe	28
PID 1136 wrote to memory of 1736	1136	rundll32.exe	28
PID 1136 wrote to memory of 1736	1136	rundll32.exe	28
PID 1136 wrote to memory of 1736	1136	rundll32.exe	28
PID 1736 wrote to memory of 2244	1736	rundll32.exe	29
PID 1736 wrote to memory of 2244	1736	rundll32.exe	29
PID 1736 wrote to memory of 2244	1736	rundll32.exe	29
PID 1736 wrote to memory of 2244	1736	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7za.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7za.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 224
    3⤵
    - Program crash
    PID:2244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads