59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1

Resubmissions

21-02-2023 11:37

17-02-2023 05:38

13-02-2023 12:09

08-02-2023 04:11

Target

59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1.dll
Size

1.0MB
MD5

46808efd5331489a931e51792623caca
SHA1

1e7e75bcee397e9c447edb7a7a20a5c81eee8a87
SHA256

59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1
SHA512

33fcf014dba7718a7e99a4860854b6067e525c8e1ab187dd9468fd4913fe7fe450b89beb5c915e424288857ce6137f96ef970d26b9bd061991d1d6a97e63b853
SSDEEP

24576:oYwf5ZRmacuzNSmFa10450twvOUqEB7PBd3X3m+r:WcCzNfveyUdPBdH3l

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 308 wrote to memory of 1584	308	regsvr32.exe	regsvr32.exe
PID 308 wrote to memory of 1584	308	regsvr32.exe	regsvr32.exe
PID 308 wrote to memory of 1584	308	regsvr32.exe	regsvr32.exe
PID 308 wrote to memory of 1584	308	regsvr32.exe	regsvr32.exe
PID 308 wrote to memory of 1584	308	regsvr32.exe	regsvr32.exe
PID 308 wrote to memory of 1584	308	regsvr32.exe	regsvr32.exe
PID 308 wrote to memory of 1584	308	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:308

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1.dll
2⤵
PID:1584