55ff23173fd9a290f2d8a8821bad30e41be053f755e609ca568f315a9395e6a2

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 17:04

Target

7zxa.dll
Size

221KB
MD5

04d3e794624a82228a7e683fdf22e182
SHA1

114b74e926913bb0a588e671025f9eb38e8b854b
SHA256

db3d0484228ed14ad8d3763f4880d36024fb27b189c91720ff147b92d46bcb5a
SHA512

b5767971f9075b5e483f9e77dcb50637eb81d70da86d655a230da6ad3dc5337d2a08038261f32e3867fde68fd33bf23a75b50e0381762becb46e859404e78d82
SSDEEP

3072:+ftOtcS7lCZc9Ltue1C+zV2zUmiRvgWDFSaRPQIDCuPK1gSBvAGfPFjaRv+PB7PT:etViwgLtun+soC1vx2Hr0/NG1E

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2184	2344	rundll32.exe	31
PID 2344 wrote to memory of 2184	2344	rundll32.exe	31
PID 2344 wrote to memory of 2184	2344	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7zxa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2344 -s 112
  2⤵
  PID:2184