08da2414b97649f0b0ff698dc811828a467c14920dc23a26db95f668ccae7119

Resubmissions

06/04/2023, 23:02

13/03/2023, 10:24

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
13/03/2023, 10:24

Target

84c71f7d2147673b3298b5ab6f4dce8a6bb488f8d4235b580799872e4c00e862.dll
Size

336.9MB
MD5

245257717c97504cdd4dbe261a2c47d0
SHA1

eba71c5923560e405201f467bcefa41b47887298
SHA256

84c71f7d2147673b3298b5ab6f4dce8a6bb488f8d4235b580799872e4c00e862
SHA512

b6c1cfef353e0df9a8c37ce8532f84cdc35cd852f34554f2748cbd74dd259329a6c733af5f8515faa8605070660afbac08f88af86f4f85b6f71f5a8a938868da
SSDEEP

49152:snKYCefvv6dyezQTbcPCg8vZ37FSc4o6qyeQVTQTPvTd1c:sXCe3sEcPX86X5388

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 1324	1304	regsvr32.exe	28
PID 1304 wrote to memory of 1324	1304	regsvr32.exe	28
PID 1304 wrote to memory of 1324	1304	regsvr32.exe	28
PID 1304 wrote to memory of 1324	1304	regsvr32.exe	28
PID 1304 wrote to memory of 1324	1304	regsvr32.exe	28
PID 1304 wrote to memory of 1324	1304	regsvr32.exe	28
PID 1304 wrote to memory of 1324	1304	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\84c71f7d2147673b3298b5ab6f4dce8a6bb488f8d4235b580799872e4c00e862.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\84c71f7d2147673b3298b5ab6f4dce8a6bb488f8d4235b580799872e4c00e862.dll
  2⤵
  PID:1324

memory/1324-54-0x0000000002080000-0x0000000003080000-memory.dmp

Filesize
16.0MB

Download