d6ac1d0599bd4972263f0db15815f753dff1644095ba862897eaf50dec9a1f1c

Analysis

max time kernel
133s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 11:41

Target

7z.dll
Size

1.1MB
MD5

3153abb3ee1acea396b0f7b77c0162c9
SHA1

53b98f18d8f6bef74063e7b3e6d724c4195844f1
SHA256

d6ac1d0599bd4972263f0db15815f753dff1644095ba862897eaf50dec9a1f1c
SHA512

2c4bb7c39c32b2ef4a27e2a9a96b285aaed1e424eecb509b32c2a13bfc955bb726a8c699de478f86cbaf23c9453e4a37620a06b5d56a5001d0bcae003e3bb904
SSDEEP

24576:w03L/0dyba7B7qmVZted3pNf2K1gxFst8TvUrIrnOGC2r8GNhgNFNA2p0Ym:t3L/VaMmVZted3/f27xhUrIrn9ZoUhg0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4104	3772	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 3772	4928	rundll32.exe	83
PID 4928 wrote to memory of 3772	4928	rundll32.exe	83
PID 4928 wrote to memory of 3772	4928	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7z.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7z.dll,#1
  2⤵
  PID:3772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 600
    3⤵
    - Program crash
    PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3772 -ip 3772
1⤵
PID:3992