6bb547b4b36e9aa1e2af887b18a3f056bd568c7dbd94b5b12ba531c0c1f89661

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 21:27

Target

12f3fa597ffa8952a4f5d37665394cc6.dll
Size

116KB
MD5

12f3fa597ffa8952a4f5d37665394cc6
SHA1

1f548929e90bd97c394252199101ae86d319e953
SHA256

6bb547b4b36e9aa1e2af887b18a3f056bd568c7dbd94b5b12ba531c0c1f89661
SHA512

47ea7613aa2728d8a53a2bb0e965697f867fa653c476530f0fa125bd4a48e5fb3d2705e2d59aa172a6c9145cb462c0b5a4b535a0b32da8719bb9878dc10b993d
SSDEEP

3072:FN0GxvNd6zH7Qmb/GcndhkCudjLOadSScvuvuYCqkly8lo4mmmok9:FNnVParGvunqkl/lo4Du

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2556	2184	regsvr32.exe	28
PID 2184 wrote to memory of 2556	2184	regsvr32.exe	28
PID 2184 wrote to memory of 2556	2184	regsvr32.exe	28
PID 2184 wrote to memory of 2556	2184	regsvr32.exe	28
PID 2184 wrote to memory of 2556	2184	regsvr32.exe	28
PID 2184 wrote to memory of 2556	2184	regsvr32.exe	28
PID 2184 wrote to memory of 2556	2184	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\12f3fa597ffa8952a4f5d37665394cc6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\12f3fa597ffa8952a4f5d37665394cc6.dll
  2⤵
  PID:2556