785d71950c369a273ded2c1e4159b0d06bcd9fd63a5eefb2288ba77bbfc2b67d

Analysis

max time kernel
13s
max time network
22s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
07-01-2025 00:05

Target

123/7zxa.dll
Size

221KB
MD5

04d3e794624a82228a7e683fdf22e182
SHA1

114b74e926913bb0a588e671025f9eb38e8b854b
SHA256

db3d0484228ed14ad8d3763f4880d36024fb27b189c91720ff147b92d46bcb5a
SHA512

b5767971f9075b5e483f9e77dcb50637eb81d70da86d655a230da6ad3dc5337d2a08038261f32e3867fde68fd33bf23a75b50e0381762becb46e859404e78d82
SSDEEP

3072:+ftOtcS7lCZc9Ltue1C+zV2zUmiRvgWDFSaRPQIDCuPK1gSBvAGfPFjaRv+PB7PT:etViwgLtun+soC1vx2Hr0/NG1E

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2340	1820	rundll32.exe	28
PID 1820 wrote to memory of 2340	1820	rundll32.exe	28
PID 1820 wrote to memory of 2340	1820	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\123\7zxa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1820 -s 112
  2⤵
  PID:2340