1112505820b2ddfbc0c1306073bd504635895fe865e4b03ecf76b4ef30051e73

Resubmissions

06/04/2023, 23:00

13/03/2023, 10:25

max time kernel
24s
max time network
31s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
13/03/2023, 10:25

Target

ec07e185f5df2d07b1c83f65e13e5cc9a77dd1c42aa311bac2eaf7cc921d8d4d.dll
Size

298.0MB
MD5

fefc02dd495ab8b6adf74b6f9d69e774
SHA1

699246876e6140a4dc3a7c44578565628f1accfa
SHA256

ec07e185f5df2d07b1c83f65e13e5cc9a77dd1c42aa311bac2eaf7cc921d8d4d
SHA512

ce579859d7d97952e444ee2ac5e1fa83f5957451045da1ad8dccf928d1c9e1e2abd18063f8c0deabf1a8d21322b6c44e10ecfde7cb58ec027f653cdb842fc32c
SSDEEP

196608:dywqPjZL2prjsEr5NUR4ureIXH5yJ7nxkYuQPP3r7DbGF/UALgV:dy8jsEr5NUR4ureIXYjTuQPPy/UQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 940	956	regsvr32.exe	28
PID 956 wrote to memory of 940	956	regsvr32.exe	28
PID 956 wrote to memory of 940	956	regsvr32.exe	28
PID 956 wrote to memory of 940	956	regsvr32.exe	28
PID 956 wrote to memory of 940	956	regsvr32.exe	28
PID 956 wrote to memory of 940	956	regsvr32.exe	28
PID 956 wrote to memory of 940	956	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ec07e185f5df2d07b1c83f65e13e5cc9a77dd1c42aa311bac2eaf7cc921d8d4d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ec07e185f5df2d07b1c83f65e13e5cc9a77dd1c42aa311bac2eaf7cc921d8d4d.dll
  2⤵
  PID:940

memory/940-54-0x0000000001FE0000-0x0000000002FE0000-memory.dmp

Filesize
16.0MB

Download
memory/940-55-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/940-58-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/940-59-0x0000000014AF0000-0x0000000014AF1000-memory.dmp

Filesize
4KB

Download