b04271110e0a85981e3d6166273424d3e23825080e73d4c9c26a9b24c77a8718 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 14:58

Sharing

Report Analysis Logs

General

Target

7z.dll
Size

969KB
MD5

653d9c59a7d6ae465bfb42e3d86453ef
SHA1

91650c62fb6e2963ccf9c5773282850e2bbe7b74
SHA256

f7158dcc1b351ca7a2e2568df56b9d2a119e6db0645a437e7034e3360327c621
SHA512

920d9b75dd3d870024041e8020d06e37040ec8bbaa05d151947ce4ed11d933ecdd24632a0aeddc18b7869d3ed836ac278222a4e9cb131f7f3d77a446febcd768
SSDEEP

12288:tShGCJhSInx/GrgWXQ/DegMAX57YVkNrn6DssCAR+ztwTZGM:tMbGr1greg35cV8rn6DssnRpoM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1760	2440	rundll32.exe	28
PID 2440 wrote to memory of 1760	2440	rundll32.exe	28
PID 2440 wrote to memory of 1760	2440	rundll32.exe	28
PID 2440 wrote to memory of 1760	2440	rundll32.exe	28
PID 2440 wrote to memory of 1760	2440	rundll32.exe	28
PID 2440 wrote to memory of 1760	2440	rundll32.exe	28
PID 2440 wrote to memory of 1760	2440	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7z.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7z.dll,#1
  2⤵
  PID:1760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads