547ef48f46ecfe31ee7edc7bbff0c2406f43d11915bcef84372172873012eacd | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 15:42

Sharing

Report Analysis Logs

General

Target

VFS/ProgramFilesX64/13/Far/7-ZipFar64.dll
Size

458KB
MD5

f8c737ca365dbbae5e0010e75bd641b3
SHA1

997b00a5807ffff06298b11e6c5cd427dc8d2402
SHA256

05c932f7c7391ba29b3dec39a7e273a9b51f1c6bd75b0aa942c08e1fa91dced8
SHA512

5f632dc5f85eab78ba7030be0347e497e309c4ebf109fb765368171ad5e56361f797bc742b25b1296240a02ed55eb4c14b76be849149b3b6367a00792fcdc7be
SSDEEP

12288:SkQxAVquWibWM1ysXvTz4NaGVg/6k+VrKk:lqni6M1yovTz4NaGY6nRK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 328 wrote to memory of 2516	328	rundll32.exe	WerFault.exe
PID 328 wrote to memory of 2516	328	rundll32.exe	WerFault.exe
PID 328 wrote to memory of 2516	328	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VFS\ProgramFilesX64\13\Far\7-ZipFar64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:328
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 328 -s 120
  2⤵
  PID:2516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads