7bef645ef38227df5ceec2ea4cf7903f9eb8e3266bc15885a8b03207eaf35aee | Triage

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 16:53

Sharing

Report Analysis Logs

General

Target

Bin64/7z.dll
Size

1.7MB
MD5

b29f85b22d2e6ac0d5cf15b6a0510bcd
SHA1

a1e45b6714e72ad9bbb624b31071a2e595aaf638
SHA256

21b1e2073057a014231997305f7922c463c50f8901dae05f94d9057e877ce138
SHA512

7188721b5efb45433e5281352ab1f2e133a3fb2ff6b320099f31d4ddaedc2337836a35cfa28d160d28e5572aa57495f812a0a75295655545afab2540e7f35173
SSDEEP

24576:Rznngr4eig/HxkaoDFITvg9iLXYgIcjWBzb139EOapmYpda:Rz64gxnoRGI9MXFrjWLNEOapmYpM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2808	2764	rundll32.exe	28
PID 2764 wrote to memory of 2808	2764	rundll32.exe	28
PID 2764 wrote to memory of 2808	2764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bin64\7z.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2764 -s 124
  2⤵
  PID:2808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads