6dc3e8f3e9d416228fc641e19080298813d2a8fcd2840e6b13282f754b79f5da

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 00:23

Target
7z.dll
Size 925KB
Sample240528-appnhsgf72
SHA256 ea50f78c5b059d910a5f7cbd9ff8270006a75c218ea49d31e499984f0ff24a34
MD5 7ed8309941fa7ccf969a8d6a4e8c60e9
SHA1 e195dffc8801a18e618e5f621f3dec2978dc00d8
SHA512 552b7a4cc2cbd20f8719016c9865c1d82fd350678fc5ccd7180b53011891295c065b79a49340ba1e74c9d60d0bb35d0bb6bd6776cc88c361db8db70b9901817e
SSDEEP 24576:FV2HCCoh4NzNungvvkkMcrnZOLY3bdYUC:qi7yNzXh7rnZOM3JY
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1756	1200	rundll32.exe	28
PID 1200 wrote to memory of 1756	1200	rundll32.exe	28
PID 1200 wrote to memory of 1756	1200	rundll32.exe	28
PID 1200 wrote to memory of 1756	1200	rundll32.exe	28
PID 1200 wrote to memory of 1756	1200	rundll32.exe	28
PID 1200 wrote to memory of 1756	1200	rundll32.exe	28
PID 1200 wrote to memory of 1756	1200	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7z.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7z.dll,#1
  2⤵
  PID:1756