5ea69fd3207a0ed6b42d5e406ee3391ddfbe19c368c7e28a6dc500fab7e84f4b

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/01/2025, 13:42

Target

7zxa.dll
Size

221KB
MD5

04d3e794624a82228a7e683fdf22e182
SHA1

114b74e926913bb0a588e671025f9eb38e8b854b
SHA256

db3d0484228ed14ad8d3763f4880d36024fb27b189c91720ff147b92d46bcb5a
SHA512

b5767971f9075b5e483f9e77dcb50637eb81d70da86d655a230da6ad3dc5337d2a08038261f32e3867fde68fd33bf23a75b50e0381762becb46e859404e78d82
SSDEEP

3072:+ftOtcS7lCZc9Ltue1C+zV2zUmiRvgWDFSaRPQIDCuPK1gSBvAGfPFjaRv+PB7PT:etViwgLtun+soC1vx2Hr0/NG1E

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1912	2332	rundll32.exe	30
PID 2332 wrote to memory of 1912	2332	rundll32.exe	30
PID 2332 wrote to memory of 1912	2332	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7zxa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2332 -s 112
  2⤵
  PID:1912