09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264 | Triage

Resubmissions

07-08-2024 11:52

240807-n1s2zaybqp 5

06-08-2024 19:50

240806-yj8q7sydpr 7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 19:50

Sharing

Report Analysis Logs

General

Target

7za.dll
Size

394KB
MD5

71ebac040d32560bb9d76a552a7cb986
SHA1

a787a8138e01624dd565775a5b500b91a46c2b68
SHA256

1aa51aa9bb50b26bb652d9c442208db76546286b0db169c8882de97d1117029d
SHA512

9a8072fc8b195a362610e7362a25e6deea84004284e51ae4678dbe457474c78e2f0ac5dc553c556b12a50139c784978971ce3786925551f388d18f8a33f0a79b
SSDEEP

6144:rZELGRFN1bebYTbCPWTdZs0Lanbhu2mzA0ph7/e3HLzmwMavWU:dELGt1bebYT2P+dZ0nhah7/kzmS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2148	2364	rundll32.exe	31
PID 2364 wrote to memory of 2148	2364	rundll32.exe	31
PID 2364 wrote to memory of 2148	2364	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7za.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2364 -s 120
  2⤵
  PID:2148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads