8bc4d422624113b2af547b64fa7df842b821f189ca4d7bad6e75767fec4a9e59

Analysis

max time kernel
92s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 17:28

Target
data/7zxa.dll
Size 155KB
Sample240527-v2fllacf56
SHA256 d0680ac62e94f953df031533acd0acb718ad8494f938d84198c655507709e5df
MD5 786d4c74c05832a652be5c0a559be1e6
SHA1 56bc5cf0bef56565da871af9e10ac8c2302d2ad7
SHA512 29cf07d3acceb716a2e9ec66434170ba7f15c5af3c843253d72be6f7bf1ab942a6e098a423beb33efb9fbf8bb6c967c34d4dedf65aca72984c6aa70c58e0eeb4
SSDEEP 3072:QwBYN3i204AHpzTjaLd4+OTpLcl28hpQplf4btKL6mCF:E3cp3jaLupLc3fclAKmJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3948	3624	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 3624	4844	rundll32.exe	82
PID 4844 wrote to memory of 3624	4844	rundll32.exe	82
PID 4844 wrote to memory of 3624	4844	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\7zxa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\7zxa.dll,#1
  2⤵
  PID:3624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 600
    3⤵
    - Program crash
    PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3624 -ip 3624
1⤵
PID:452