7cbc7942fa46f2f7db1e8c22395c384527769754aa38b2a348837c10e75e022f

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 16:59

Target

06fcacd3ecc0b625d8cc9dc34dd15efb.dll
Size

176KB
MD5

06fcacd3ecc0b625d8cc9dc34dd15efb
SHA1

2ec858d5209f42ddb8703e1a943a383b831eb0a5
SHA256

7cbc7942fa46f2f7db1e8c22395c384527769754aa38b2a348837c10e75e022f
SHA512

bed45e4fa3984e0b1c72635964b0e9a9b0e27f6048eeec8c74198d4cc417ba0b203d455e0da30367e682a609b27d5c30be66ebe3c5ccbffd07aff41cfdee2ae4
SSDEEP

3072:/BXLVMhsx5FwY2I5PgAp2DMelYBFeM4FcCG7TCnp5cvLi22yT:/BXLUI535PgFMwAcM4RG7TTvL32yT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2084	3028	regsvr32.exe	24
PID 3028 wrote to memory of 2084	3028	regsvr32.exe	24
PID 3028 wrote to memory of 2084	3028	regsvr32.exe	24
PID 3028 wrote to memory of 2084	3028	regsvr32.exe	24
PID 3028 wrote to memory of 2084	3028	regsvr32.exe	24
PID 3028 wrote to memory of 2084	3028	regsvr32.exe	24
PID 3028 wrote to memory of 2084	3028	regsvr32.exe	24

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\06fcacd3ecc0b625d8cc9dc34dd15efb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\06fcacd3ecc0b625d8cc9dc34dd15efb.dll
  2⤵
  PID:2084