bc4101cb2be2bc8fedb16c82b4c4dc808176f519f9c2c8012c6e18b4b35d932d | Triage

Analysis

max time kernel
124s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-06-2024 07:54

Sharing

Report Analysis Logs

General

Target

7ZipDLL.dll
Size

557KB
MD5

2d7f717f9a5fb567848c3c4f11cc95c2
SHA1

bd94031c8a4fcbfcb00b401641094277ea83ef11
SHA256

775ab21d46bfa4c5206feb37a2dcb412c196090c74faeca5b11372b178a705f7
SHA512

af0e28bc4bff2604239cf78bf38ff188289f1c28e17875147600804017809b41c5fe67041bbfd41c97d6c5d3de6d86d4d7ff3378543c717c9f4bffc3386923c2
SSDEEP

12288:02MvfS+YHC1+jheuOUoVXusOlNpvL/MwE:Ui+MC16euOUoA0j

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 2412	1396	rundll32.exe	92
PID 1396 wrote to memory of 2412	1396	rundll32.exe	92
PID 1396 wrote to memory of 2412	1396	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ZipDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ZipDLL.dll,#1
  2⤵
  PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4288,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
1⤵
PID:3120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads