0058b4f69b0e6b9fc2eaca10a9bfb41e72e6cd72a827f8740fefde876194bade

Analysis

max time kernel
33s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
08/09/2022, 02:29

Target

PowerISO/App/PowerISO64/7z-x64.dll
Size

1.7MB
MD5

bbf51226a8670475f283a2d57460d46c
SHA1

6388883ced0ce14ede20c7798338673ff8d6204a
SHA256

73578f14d50f747efa82527a503f1ad542f9db170e2901eddb54d6bce93fc00e
SHA512

f68eb9c4ba0d923082107cff2f0e7f78e80be243b9d92cfab7298f59461fcca2c5c944d4577f161f11a2011c0958a3c32896eba4f0e89cd9f8aed97ab5bc74f9
SSDEEP

24576:fznngr4eig/HxkaoDFITvg9iLXYgIcjWBzb139EOapmYp:fz64gxnoRGI9MXFrjWLNEOapmYp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
840	1768	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 840	1768	rundll32.exe	27
PID 1768 wrote to memory of 840	1768	rundll32.exe	27
PID 1768 wrote to memory of 840	1768	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PowerISO\App\PowerISO64\7z-x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1768 -s 124
  2⤵
  - Program crash
  PID:840