Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 04:18
Static task
static1
Behavioral task
behavioral1
Sample
7z.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7z.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
7z.exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
7z.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
7zFM.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
7zFM.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
7zG.exe
Resource
win7-20231129-en
General
-
Target
7z.dll
-
Size
1.0MB
-
MD5
2e8048095c77456188fb22c27a74f045
-
SHA1
7505af30f62511a729158364f24167cf69479542
-
SHA256
75ffcf87077edeb7197096b496721d7d42e762f1b99863998463fbc812dfaf15
-
SHA512
7f80888c9291c43e1dba9670bbb7ea9612fed7ce93ee6c7b33ef2f86e1d3e7de7a95fee905524b557ade961e21c27e62cd94f33fd971cc49bd0fc24518149a3c
-
SSDEEP
24576:xW+wsDaQw6DDz3qRyPnmGfrnvVUKueY8RmneWtJoWnvQUvB:xasY6DwOBfrnvV7UeWtG0HB
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4900 wrote to memory of 2548 4900 rundll32.exe 90 PID 4900 wrote to memory of 2548 4900 rundll32.exe 90 PID 4900 wrote to memory of 2548 4900 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7z.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7z.dll,#12⤵PID:2548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4324 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:81⤵PID:3900