eb04ae31de75a0175da515804d3272a86b09ad13781b07f126c4ec033f2dac13

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/12/2023, 05:42

Target

eb04ae31de75a0175da515804d3272a86b09ad13781b07f126c4ec033f2dac13.dll
Size

1016KB
MD5

4b5bd015fc107f6925be06ef5a2391fa
SHA1

141068488bc4f689d30479eedfe1c85842cbf6ad
SHA256

eb04ae31de75a0175da515804d3272a86b09ad13781b07f126c4ec033f2dac13
SHA512

a2dc3f8550105f6417b13c0e10731105412dc507409f59af2fd8df0aa5f6c0a7e49e4e564e68b1c475cc272a9504421d863e4343c2aced0166abcf913ab38f75
SSDEEP

6144:f/HQUkNucwkPWpP1wf5Z/CKfxS6unK+ShaaeyFFmRRANWGLY6aaOuMdGNopDd3EB:fIUkNukOelBES6RuIGk6aaOBY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2992	2620	regsvr32.exe	28
PID 2620 wrote to memory of 2992	2620	regsvr32.exe	28
PID 2620 wrote to memory of 2992	2620	regsvr32.exe	28
PID 2620 wrote to memory of 2992	2620	regsvr32.exe	28
PID 2620 wrote to memory of 2992	2620	regsvr32.exe	28
PID 2620 wrote to memory of 2992	2620	regsvr32.exe	28
PID 2620 wrote to memory of 2992	2620	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\eb04ae31de75a0175da515804d3272a86b09ad13781b07f126c4ec033f2dac13.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\eb04ae31de75a0175da515804d3272a86b09ad13781b07f126c4ec033f2dac13.dll
  2⤵
  PID:2992