913ecfd11233aba6a8af3480baa08d21d4d34729891e7caf840198393fc135d9 | Triage

Analysis

max time kernel
138s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 03:08

Sharing

Report Analysis Logs

General

Target

Box/7zMgr.dll
Size

88KB
MD5

8e35951700bf761f047778a51c26d135
SHA1

0106395021085a720b433e8b8a5bef2afc56fb44
SHA256

395db5f558564f4fd8ffe4320e0cc880f15439723131bf817def376e41969ec2
SHA512

d215dd77c9e37539ea6125de565701adf7fe917706667326e722532559f0c0705a9b8ebb3432596eb4a4df16dd8e9f29cafff26936eefacc6d86b545b4cc0de1
SSDEEP

1536:nWHWA4Gi2aaoOyiaTMgoDY1JucXySL8ol6zC:ne4Gi2aaN7WaYI4L8ol6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3984 wrote to memory of 4996	3984	rundll32.exe	rundll32.exe
PID 3984 wrote to memory of 4996	3984	rundll32.exe	rundll32.exe
PID 3984 wrote to memory of 4996	3984	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Box\7zMgr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3984

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Box\7zMgr.dll,#1
2⤵
PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...