32abdd2910a308d9db26293a2be62184462ed68595d369b1002a72a614bfea72

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 00:57 UTC

Target

env/Scripts/dist/7zxa.dll
Size

220KB
MD5

85026cfba1afed081a84f70c3cf46815
SHA1

4231a9a70229fe7a6f8aa92109002caeb642a8ce
SHA256

f4953bebeb4b71f3f83e4684c5349b0ee9263499df3cc0b2be830ef2c478d50a
SHA512

742ad90f66c6815a61262c48685af7676cb94783e59fcd05d4f53329491e7b1c2be4c8f2c9eeeb02422f2a7b4d8ef224ffc39a76bc53270d2ce8e31df7fa8ebd
SSDEEP

3072:fva4wzxd5iNVYCWprqMCRvAmpkZSXovw47iuoRIpzdSQCg2MPFWrRP+4jIPLQyAz:nqN/iYPrq2nwmx2HX0psmBgVay

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2392	1368	rundll32.exe	28
PID 1368 wrote to memory of 2392	1368	rundll32.exe	28
PID 1368 wrote to memory of 2392	1368	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\env\Scripts\dist\7zxa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1368 -s 112
  2⤵
  PID:2392