749d40671442c6101b111f1045e6a489d57c54863662d1e74965359fa0cca215 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09-06-2024 20:58

Sharing

Report Analysis Logs

General

Target

7z.dll
Size

999KB
MD5

03221f2c4708e8e8fcd5a5f323a3a6cb
SHA1

7b0991f89da28a5e3098532437dd5f6fe23e3ef2
SHA256

4ca526634a2336521b6925606f93592cd7dab4db9026c5545bd2b9f2ee365a61
SHA512

f757d6981a55b4f21fc0c1f60e1f0d789cfb4f991276d9aa6267a4a6d352b163e36f4275cfc8dbee0fd60db21c4ade735691ae0a71b199f8f70eddfb13312d72
SSDEEP

24576:HbxlYZpZ3h8uRvtonDbfmaxEGuqNSauKOdZLs8nKMh1a8B/EsJE:H1leZ3xzonPmCEGpXOLLs8nnvb/EsJE

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1740 1852 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 1740	1852	rundll32.exe	WerFault.exe
PID 1852 wrote to memory of 1740	1852	rundll32.exe	WerFault.exe
PID 1852 wrote to memory of 1740	1852	rundll32.exe	WerFault.exe
PID 1852 wrote to memory of 1740	1852	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7z.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7z.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 224
3⤵
- Program crash
PID:1740

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...