8bc4d422624113b2af547b64fa7df842b821f189ca4d7bad6e75767fec4a9e59

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 17:28

Target
data/7zxa.dll
Size 155KB
Sample240527-v2fllacf56
SHA256 d0680ac62e94f953df031533acd0acb718ad8494f938d84198c655507709e5df
MD5 786d4c74c05832a652be5c0a559be1e6
SHA1 56bc5cf0bef56565da871af9e10ac8c2302d2ad7
SHA512 29cf07d3acceb716a2e9ec66434170ba7f15c5af3c843253d72be6f7bf1ab942a6e098a423beb33efb9fbf8bb6c967c34d4dedf65aca72984c6aa70c58e0eeb4
SSDEEP 3072:QwBYN3i204AHpzTjaLd4+OTpLcl28hpQplf4btKL6mCF:E3cp3jaLupLc3fclAKmJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2156	2260	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2260	2248	rundll32.exe	28
PID 2248 wrote to memory of 2260	2248	rundll32.exe	28
PID 2248 wrote to memory of 2260	2248	rundll32.exe	28
PID 2248 wrote to memory of 2260	2248	rundll32.exe	28
PID 2248 wrote to memory of 2260	2248	rundll32.exe	28
PID 2248 wrote to memory of 2260	2248	rundll32.exe	28
PID 2248 wrote to memory of 2260	2248	rundll32.exe	28
PID 2260 wrote to memory of 2156	2260	rundll32.exe	29
PID 2260 wrote to memory of 2156	2260	rundll32.exe	29
PID 2260 wrote to memory of 2156	2260	rundll32.exe	29
PID 2260 wrote to memory of 2156	2260	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\7zxa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\7zxa.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 220
    3⤵
    - Program crash
    PID:2156