055987930bd9298208f538d63bbd79a46158fde009d047f55699c56739518f85

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
05/10/2023, 18:20

Target

055987930bd9298208f538d63bbd79a46158fde009d047f55699c56739518f85.dll
Size

64KB
MD5

8cc378ba3285e7924e388a2b8220de69
SHA1

0fe02961bab286ef6a98eab22611986e0a929600
SHA256

055987930bd9298208f538d63bbd79a46158fde009d047f55699c56739518f85
SHA512

8825f413d648ac07dde664d94a711a5c581724938cc812423aa454827836b29789b69bd3eb747a0d040e3f39c36c578b5b13962c977d05481751072b98e0f1bf
SSDEEP

768:IpXg0bUHbh0+fqpG5S0A4hRyz1SJlDo3xqXBvZ:pN0+fqpG5o4hMz1ch

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1896	2388	regsvr32.exe	28
PID 2388 wrote to memory of 1896	2388	regsvr32.exe	28
PID 2388 wrote to memory of 1896	2388	regsvr32.exe	28
PID 2388 wrote to memory of 1896	2388	regsvr32.exe	28
PID 2388 wrote to memory of 1896	2388	regsvr32.exe	28
PID 2388 wrote to memory of 1896	2388	regsvr32.exe	28
PID 2388 wrote to memory of 1896	2388	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\055987930bd9298208f538d63bbd79a46158fde009d047f55699c56739518f85.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\055987930bd9298208f538d63bbd79a46158fde009d047f55699c56739518f85.dll
  2⤵
  PID:1896