1d11c54162d078fa1c68e40907af7f5719e81fae2794581a2eb29cd87b67979d

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 20:03

Target

NEAS.2ab147a24fa4e572da70d13a1ec2d750.dll
Size

267KB
MD5

2ab147a24fa4e572da70d13a1ec2d750
SHA1

fdbe875d70f672b78786a936351d86225eb1076d
SHA256

1d11c54162d078fa1c68e40907af7f5719e81fae2794581a2eb29cd87b67979d
SHA512

c1d23e48883117bf9e77ba170e48cd3dc5d41f857420d133618d183a2b2762f7bd921614f96492ef2ccc49d68cdf2575117ad2446cc6a98eeaf8dbe49e376e87
SSDEEP

3072:o0H1uc2uIu3sUKR0mmCztr5bMKdYaGWAIoMmPQ9jGeupqrp:quxm7CKWVIuArp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2468	2464	regsvr32.exe	28
PID 2464 wrote to memory of 2468	2464	regsvr32.exe	28
PID 2464 wrote to memory of 2468	2464	regsvr32.exe	28
PID 2464 wrote to memory of 2468	2464	regsvr32.exe	28
PID 2464 wrote to memory of 2468	2464	regsvr32.exe	28
PID 2464 wrote to memory of 2468	2464	regsvr32.exe	28
PID 2464 wrote to memory of 2468	2464	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NEAS.2ab147a24fa4e572da70d13a1ec2d750.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NEAS.2ab147a24fa4e572da70d13a1ec2d750.dll
  2⤵
  PID:2468