ddb62fe8611e6e37b8b37413dea5e5f813f441e1601f8c805787a2d94265a8cb

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 11:56

Target

office2019pjb_9435/office2019pjb/OTool/files/7-zip/7za.dll
Size

240KB
MD5

8f8c8662d50a727eb783b4b6101b1fab
SHA1

38ba68fd3b1d503b2dac3db622c920a53b9b6961
SHA256

7cae87154c752deb52cd7a83fbff4be5064a424916d89cffe3bf3712fa74fc92
SHA512

91488554a54612036b3b04306d5ba165012ae35831ae5d5b79ce8213e58fb04507a7950a6e5c195903d4b1262a5e32dd251ad51ba52d2dca47789538894dbe7f
SSDEEP

3072:XmZDDcpEXd0PJIb7G5wsWK/41lP1sxy5UPLhLt9WdTmZh901MMjrnmV/RwAAAAAV:XZEXi5wsF/0P89+T5rn0VEJf415wfg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	2168	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2168	2132	rundll32.exe	28
PID 2132 wrote to memory of 2168	2132	rundll32.exe	28
PID 2132 wrote to memory of 2168	2132	rundll32.exe	28
PID 2132 wrote to memory of 2168	2132	rundll32.exe	28
PID 2132 wrote to memory of 2168	2132	rundll32.exe	28
PID 2132 wrote to memory of 2168	2132	rundll32.exe	28
PID 2132 wrote to memory of 2168	2132	rundll32.exe	28
PID 2168 wrote to memory of 2184	2168	rundll32.exe	29
PID 2168 wrote to memory of 2184	2168	rundll32.exe	29
PID 2168 wrote to memory of 2184	2168	rundll32.exe	29
PID 2168 wrote to memory of 2184	2168	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\7-zip\7za.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\7-zip\7za.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 224
    3⤵
    - Program crash
    PID:2184