31e8dda13e7a2e04829a653f8d30ddea96763b4045c6f9123160539cbf7b1e14 | Triage

Analysis

max time kernel
139s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 11:34

Sharing

Report Analysis Logs

General

Target

$SYSDIR/360zip/360zipw.dll
Size

562KB
MD5

b381954ae1edb8720724d7efb36242be
SHA1

29850752e4a65fbe486e6f4b7900a570f2328e72
SHA256

a156a8280d4d38cd8a4be6c5a2ce44e1c7aba042615ca8c0d4e556bf87718545
SHA512

d027b5f20ced038d3cc95b9241e323c057db5c34a2639e2636946ba3c9937ceba164b9df7c922e5b2459756be863e9aed13f0303146eee23bc9a7b01b33e70c4
SSDEEP

12288:F77gQ+EGbgCVQjzEjjXCodj/SeKfdM1/+wcHzueAcubK2SIV:tg4sV1z2feAwAubrSu

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5084 wrote to memory of 2332	5084	rundll32.exe	rundll32.exe
PID 5084 wrote to memory of 2332	5084	rundll32.exe	rundll32.exe
PID 5084 wrote to memory of 2332	5084	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\360zip\360zipw.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5084

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\360zip\360zipw.dll,#1
2⤵
PID:2332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:3612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...