aef3b5aede880899734dd45fa1dd7a174a5766c4da49d493a3f8fc0c5389144e

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230824-en
resource tags

arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
submitted
29-08-2023 10:52

Target

aef3b5aede880899734dd45fa1dd7a174a5766c4da49d493a3f8fc0c5389144e.dll
Size

80KB
MD5

c68dadbdfa3a7d85288b3674a732c0df
SHA1

809682fe674e5a8412340b0717b6bf1142baacc3
SHA256

aef3b5aede880899734dd45fa1dd7a174a5766c4da49d493a3f8fc0c5389144e
SHA512

5b2eda55fb230de57ed062484cde6d334a58c66631a6985135d4aea1ff1aad0aab62eb1d0b56d0dc5f875001ee71c2bce79da71631272693a8d222e31e6c0641
SSDEEP

768:wQYIsOIF7zobywFpk4jKuoGaq5xEsZ6WaYUxTUUUTxUTxGxrTwF1mIS1NDut:Hs74bBzX315xIWEF1mISHD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1940	1488	regsvr32.exe	28
PID 1488 wrote to memory of 1940	1488	regsvr32.exe	28
PID 1488 wrote to memory of 1940	1488	regsvr32.exe	28
PID 1488 wrote to memory of 1940	1488	regsvr32.exe	28
PID 1488 wrote to memory of 1940	1488	regsvr32.exe	28
PID 1488 wrote to memory of 1940	1488	regsvr32.exe	28
PID 1488 wrote to memory of 1940	1488	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\aef3b5aede880899734dd45fa1dd7a174a5766c4da49d493a3f8fc0c5389144e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\aef3b5aede880899734dd45fa1dd7a174a5766c4da49d493a3f8fc0c5389144e.dll
  2⤵
  PID:1940