9b587f0574d013ada38f6973195e0ebcb1889952370dd3396e9f89e3622ff81a | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 01:43

Sharing

Report Analysis Logs

General

Target

7z/7z.dll
Size

709KB
MD5

ca41d56630191e61565a343c59695ca1
SHA1

774584ff54b38da5d3b3ee02e30908dacab175c5
SHA256

6c80e3f49fcf561e6a0b52f9b4c81d1d07b22085f7864ee4cfd30dd10f6b3b12
SHA512

7f2eb8f773951c5b682b208807235bf4d7d937ece3d9d5c30d17abeb8f74e0be016140e74c64f9d38440269784308ed53c9c76dce6850afa1c7f9cb701229fe1
SSDEEP

12288:ICR0sfbz8QwSOh+PBFayDTAZju0sBdZ7ATm8zI:I9GX8JSOM5FayDTAZa0GdZ7G9E

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1508 wrote to memory of 1852	1508	rundll32.exe	rundll32.exe
PID 1508 wrote to memory of 1852	1508	rundll32.exe	rundll32.exe
PID 1508 wrote to memory of 1852	1508	rundll32.exe	rundll32.exe
PID 1508 wrote to memory of 1852	1508	rundll32.exe	rundll32.exe
PID 1508 wrote to memory of 1852	1508	rundll32.exe	rundll32.exe
PID 1508 wrote to memory of 1852	1508	rundll32.exe	rundll32.exe
PID 1508 wrote to memory of 1852	1508	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7z\7z.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7z\7z.dll,#1
  2⤵
  PID:1852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads