2cc37659a885df758b5c58ce767fe0c6dba9b77009ee28b72eedb01655e11f65

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 07:36

Target

2cc37659a885df758b5c58ce767fe0c6dba9b77009ee28b72eedb01655e11f65.dll
Size

6.5MB
MD5

cade1e0677024123de1da6d4f876e923
SHA1

e27fb7375b54239d729aef1075fb1259dcfa5e58
SHA256

2cc37659a885df758b5c58ce767fe0c6dba9b77009ee28b72eedb01655e11f65
SHA512

5ff14b438ce1e0f9b1ea73864d18a3aa6927b6c348bfe151344c2bc41271b4bc313a722e1c8454546b247f83cf3b15dd8b6d1b2c386b8aeff5f4a8ce1bb90995
SSDEEP

98304:QmWMpd9xotayiD5QjbmScHMmMNzCYkeyrLAwQLASjZGQoSkbRFcd:QzMpd9xoUy85QjbmScHMmMNzCYyE1iRQ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2992	2596	regsvr32.exe	28
PID 2596 wrote to memory of 2992	2596	regsvr32.exe	28
PID 2596 wrote to memory of 2992	2596	regsvr32.exe	28
PID 2596 wrote to memory of 2992	2596	regsvr32.exe	28
PID 2596 wrote to memory of 2992	2596	regsvr32.exe	28
PID 2596 wrote to memory of 2992	2596	regsvr32.exe	28
PID 2596 wrote to memory of 2992	2596	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2cc37659a885df758b5c58ce767fe0c6dba9b77009ee28b72eedb01655e11f65.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2cc37659a885df758b5c58ce767fe0c6dba9b77009ee28b72eedb01655e11f65.dll
  2⤵
  PID:2992