020452d65d51079ee5ff492d49915b34fda40886045ceb29ec1d59400b5b52c5

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 06:11

Target

020452d65d51079ee5ff492d49915b34fda40886045ceb29ec1d59400b5b52c5.dll
Size

283KB
MD5

0360861efc4323a139d7a150afa86f6b
SHA1

e6279b8aea376ea3685f0780fc8dde784a324135
SHA256

020452d65d51079ee5ff492d49915b34fda40886045ceb29ec1d59400b5b52c5
SHA512

555e1062a4c27554665ace3fe7cbbcdac7671585d62ce8aa938697b6b125405f33b5f8e54d209ffe2660b64bbbc01b06975993cabfe5ca88742591d40111592e
SSDEEP

6144:As85NNEl9YcuCmZRHYp0mq4OWfX87k5jUkrKo+4fJgH8AhyzF:WCtlV0k5jNKb4Jo8XzF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1748	2308	regsvr32.exe	28
PID 2308 wrote to memory of 1748	2308	regsvr32.exe	28
PID 2308 wrote to memory of 1748	2308	regsvr32.exe	28
PID 2308 wrote to memory of 1748	2308	regsvr32.exe	28
PID 2308 wrote to memory of 1748	2308	regsvr32.exe	28
PID 2308 wrote to memory of 1748	2308	regsvr32.exe	28
PID 2308 wrote to memory of 1748	2308	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\020452d65d51079ee5ff492d49915b34fda40886045ceb29ec1d59400b5b52c5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\020452d65d51079ee5ff492d49915b34fda40886045ceb29ec1d59400b5b52c5.dll
  2⤵
  PID:1748