a2db9afd7e2891d20b06e50870b1edda8d7d5433ad273570d1c48f90250b4e6a

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 21:38

Target

a2db9afd7e2891d20b06e50870b1edda8d7d5433ad273570d1c48f90250b4e6a.dll
Size

9.1MB
MD5

37dd025572b6a557c7d78a7877ca71d7
SHA1

49b242082715116115d0286027c2e6788f64ba7a
SHA256

a2db9afd7e2891d20b06e50870b1edda8d7d5433ad273570d1c48f90250b4e6a
SHA512

885b9dd6d3bb349912677ce0b0853b4dd0b0e052723b9d88a6f63604d94498d2ee9a99c5eed19a685ee69f14b2af2af8534a67bcba2824b3210f6807f4d53cf7
SSDEEP

98304:7lKgROSXkeeedx5xIxnxBK9Oh8vB//Q+P44GCn9enRWHakD5kDfXXXn5GwAkHn+x:7lKRSWK9O444of5dqfb9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1720	2196	regsvr32.exe	28
PID 2196 wrote to memory of 1720	2196	regsvr32.exe	28
PID 2196 wrote to memory of 1720	2196	regsvr32.exe	28
PID 2196 wrote to memory of 1720	2196	regsvr32.exe	28
PID 2196 wrote to memory of 1720	2196	regsvr32.exe	28
PID 2196 wrote to memory of 1720	2196	regsvr32.exe	28
PID 2196 wrote to memory of 1720	2196	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a2db9afd7e2891d20b06e50870b1edda8d7d5433ad273570d1c48f90250b4e6a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a2db9afd7e2891d20b06e50870b1edda8d7d5433ad273570d1c48f90250b4e6a.dll
  2⤵
  PID:1720