8af3a126d0fdbb75f766328e84c671e90e5a25fc68aeff2dfa86b259bf1caaeb

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16-10-2023 18:22

Target

NEAS.61e6e748b5acd44b3090d38e80b079d0.dll
Size

552KB
MD5

61e6e748b5acd44b3090d38e80b079d0
SHA1

d10aed33840d180e8a2805369aa3da7fd344779a
SHA256

8af3a126d0fdbb75f766328e84c671e90e5a25fc68aeff2dfa86b259bf1caaeb
SHA512

51778a119eeae291868d55dce3f076e7bfc472dbe81ae24efa24aa544633f110230438690faa1cd28e217cab8283519c7a7e9967999d91aaa9fb8bd2faf85a28
SSDEEP

6144:Q4Lyj8BA593HvPYPkxbB+m7wsFOPpJBl7O70DBZE5AB9PDAF/OAmbqnEjE:DejxT3YPkxbB+ZiipJBxO70NZF8mqnE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1388	1264	regsvr32.exe	16
PID 1264 wrote to memory of 1388	1264	regsvr32.exe	16
PID 1264 wrote to memory of 1388	1264	regsvr32.exe	16
PID 1264 wrote to memory of 1388	1264	regsvr32.exe	16
PID 1264 wrote to memory of 1388	1264	regsvr32.exe	16
PID 1264 wrote to memory of 1388	1264	regsvr32.exe	16
PID 1264 wrote to memory of 1388	1264	regsvr32.exe	16

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NEAS.61e6e748b5acd44b3090d38e80b079d0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NEAS.61e6e748b5acd44b3090d38e80b079d0.dll
  2⤵
  PID:1388