Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
13/05/2024, 11:56
General
-
Target
office2019pjb_9435/office2019pjb/OTool/files/7-zip/7zxa.dll
-
Size
138KB
-
MD5
ae27db1a0e1e2b338c79af9d74967b7d
-
SHA1
30f5bc5e12279859043c43a2dbe6a97f57bfebf8
-
SHA256
dbe966226d1df41c9ab854da3897c0fa99858d8848dd23470edb4974f256c2fa
-
SHA512
f66fc1244078bf1ba259b87f83d92a35226aa99dbb4c253c62443bc71c54dba155e10b1f781fbbd7c31f48a528821bc588da24d853fdee17cd75ecf8fcb7e35e
-
SSDEEP
3072:rSYpT3EI9ohKKZ05neKoGOehKZkgx1QYyAAAAA+8R7DL5qTqoU1ys:rjKKKKOGgb5Doe
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\7-zip\7zxa.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\7-zip\7zxa.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 6003⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3680 -ip 36801⤵