9371a656feffb9e8e4fe70ce3fa01352af3035b5afaddbe4332442fc1dbb8ff0

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-12-2024 18:38

Target

My Program/RockerLegacy/7zxa.dll
Size

221KB
MD5

04d3e794624a82228a7e683fdf22e182
SHA1

114b74e926913bb0a588e671025f9eb38e8b854b
SHA256

db3d0484228ed14ad8d3763f4880d36024fb27b189c91720ff147b92d46bcb5a
SHA512

b5767971f9075b5e483f9e77dcb50637eb81d70da86d655a230da6ad3dc5337d2a08038261f32e3867fde68fd33bf23a75b50e0381762becb46e859404e78d82
SSDEEP

3072:+ftOtcS7lCZc9Ltue1C+zV2zUmiRvgWDFSaRPQIDCuPK1gSBvAGfPFjaRv+PB7PT:etViwgLtun+soC1vx2Hr0/NG1E

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2304	2092	rundll32.exe	30
PID 2092 wrote to memory of 2304	2092	rundll32.exe	30
PID 2092 wrote to memory of 2304	2092	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\My Program\RockerLegacy\7zxa.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2092 -s 112
  2⤵
  PID:2304