e5258f592532a4592652feaa74a34a912738b19508b0e7745eb4c78f1a23808b

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
02-11-2023 15:36

Target

e5258f592532a4592652feaa74a34a912738b19508b0e7745eb4c78f1a23808b.dll
Size

657KB
MD5

42a8133fd0de3bd5eb6177df81b968c1
SHA1

5b1ce466e8006b81a863289312d0caf385197854
SHA256

e5258f592532a4592652feaa74a34a912738b19508b0e7745eb4c78f1a23808b
SHA512

7d4e9c4f60c6105fc2135f2ec5b711673b6b48fbf026076baabf2824f986e20c7f92c40339820e103cf4f6d09b14b77d64281824c85159d09900f9257e92c5b8
SSDEEP

6144:rSD53NwySbOxBpCVIR3crDln4/XljIEOLmocOD/TjevCN29eJYvC:+D5dYbgTCVSADC/ljIEOSQbb298Y6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2644	2716	regsvr32.exe	29
PID 2716 wrote to memory of 2644	2716	regsvr32.exe	29
PID 2716 wrote to memory of 2644	2716	regsvr32.exe	29
PID 2716 wrote to memory of 2644	2716	regsvr32.exe	29
PID 2716 wrote to memory of 2644	2716	regsvr32.exe	29
PID 2716 wrote to memory of 2644	2716	regsvr32.exe	29
PID 2716 wrote to memory of 2644	2716	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e5258f592532a4592652feaa74a34a912738b19508b0e7745eb4c78f1a23808b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e5258f592532a4592652feaa74a34a912738b19508b0e7745eb4c78f1a23808b.dll
  2⤵
  PID:2644