121b577a7dac22764c8d5e89c1b0504edf7803fdf6c5ed15c0c432d9605b4f7a | Triage

Analysis

max time kernel
66s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 02:00

Sharing

Report Analysis Logs

General

Target

7zxa.dll
Size

171KB
MD5

1cf011c4c0aeb50a46ce6d04ec47adf2
SHA1

80edc3f772084a8cbec182f1c588cd9f6f9c7df4
SHA256

d86b46836fd0a1d7488d1f8a01dbd831c5301c2a7b733aef584de7891cf2771a
SHA512

095f340db7c279832711ac4ed3bd932fe809f3d30d72ee6dc1357ffe4d77c6a68825967eaef4a33763bd1bfc1b476314dac44bb0552fac152ba6acd73d0660b8
SSDEEP

3072:Gc1Cwwna6ODBgYc6MDV3WX+87F0z19T1BoFOysbK9IKFFZpGCGklyIAv:GtaHDBgYP0wB7F03xysmBEC0Lv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4576 wrote to memory of 1564	4576	rundll32.exe	rundll32.exe
PID 4576 wrote to memory of 1564	4576	rundll32.exe	rundll32.exe
PID 4576 wrote to memory of 1564	4576	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7zxa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4576

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7zxa.dll,#1
2⤵
PID:1564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...