8cfb659e30b94ef25bfef16e576bb8507ee64894189c818262f3e2816714aec0

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-12-2023 01:14

Target

8cfb659e30b94ef25bfef16e576bb8507ee64894189c818262f3e2816714aec0.dll
Size

342KB
MD5

bdb03dd267d16ca5fc4ea5e10ae1fcce
SHA1

f627b7d0a46354197705279e254cc9f1638bfd24
SHA256

8cfb659e30b94ef25bfef16e576bb8507ee64894189c818262f3e2816714aec0
SHA512

b095269100de6df3ea053e28b5ada607ffaa6c1af5889a1d7185ba209089bbb5e6d530d83422542e116852cd4e4a0b49bb3087b5a74558d0879ec93808e9c340
SSDEEP

3072:nxIi2gU7QI7Cl04ccgNpJqFvcDzdT5qyIKohXyUK0e9e5pLPwLTa445gw4cLndd8:nxI/7yX6zxy7FZzaLcmTw01

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2772	2932	regsvr32.exe	28
PID 2932 wrote to memory of 2772	2932	regsvr32.exe	28
PID 2932 wrote to memory of 2772	2932	regsvr32.exe	28
PID 2932 wrote to memory of 2772	2932	regsvr32.exe	28
PID 2932 wrote to memory of 2772	2932	regsvr32.exe	28
PID 2932 wrote to memory of 2772	2932	regsvr32.exe	28
PID 2932 wrote to memory of 2772	2932	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8cfb659e30b94ef25bfef16e576bb8507ee64894189c818262f3e2816714aec0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8cfb659e30b94ef25bfef16e576bb8507ee64894189c818262f3e2816714aec0.dll
  2⤵
  PID:2772