f90867879e21c9d25daa3e434a25cd0288048a154896f58ec3ce28d3870b9653

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/07/2024, 14:42

Target

setup/7zxa.dll
Size

221KB
MD5

04d3e794624a82228a7e683fdf22e182
SHA1

114b74e926913bb0a588e671025f9eb38e8b854b
SHA256

db3d0484228ed14ad8d3763f4880d36024fb27b189c91720ff147b92d46bcb5a
SHA512

b5767971f9075b5e483f9e77dcb50637eb81d70da86d655a230da6ad3dc5337d2a08038261f32e3867fde68fd33bf23a75b50e0381762becb46e859404e78d82
SSDEEP

3072:+ftOtcS7lCZc9Ltue1C+zV2zUmiRvgWDFSaRPQIDCuPK1gSBvAGfPFjaRv+PB7PT:etViwgLtun+soC1vx2Hr0/NG1E

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 2872	2608	rundll32.exe	31
PID 2608 wrote to memory of 2872	2608	rundll32.exe	31
PID 2608 wrote to memory of 2872	2608	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\setup\7zxa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2608 -s 112
  2⤵
  PID:2872