209113be716dd92ebbc8da1c9aa8bb22adfda1da32e168055f3a56b1ddc0bbd5

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-01-2024 23:55

Target

7ZipDLL.dll
Size

528KB
MD5

f6d23610080e21cbfaa000444fadc8a1
SHA1

48c034ddc65e5fe9869dd8ece3dc84ee5e3001f7
SHA256

d0122d8e4e64e34623fd8623209064ff2f82d13b5b37be0c05da9fc02023696f
SHA512

d47ac72b87e8e9dbb61658423b7d2855b5e8cf70aa5e813b66ab52b88ead0645e8f1f905369e8e6f307306a4c477e285f22c7d0a6a01745d78e3911daac364d8
SSDEEP

6144:HQvft+9m057+DFGPx0S51SIkSj1eIbpDzhGMvKUkqvJ7nK588wFONQfnoCl3atJg:HQvfUEsx0jYeIbLGbF758xOCfytxpG+Y

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1920	2008	rundll32.exe	28
PID 2008 wrote to memory of 1920	2008	rundll32.exe	28
PID 2008 wrote to memory of 1920	2008	rundll32.exe	28
PID 2008 wrote to memory of 1920	2008	rundll32.exe	28
PID 2008 wrote to memory of 1920	2008	rundll32.exe	28
PID 2008 wrote to memory of 1920	2008	rundll32.exe	28
PID 2008 wrote to memory of 1920	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ZipDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ZipDLL.dll,#1
  2⤵
  PID:1920