4fe0f2dff88cf65771136b4a9c138b8d69ec3a7acd9937a6f8c976a1ed72a808

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 18:00

Target

0a1d69994499e940b94a00abd3177b35.dll
Size

588KB
MD5

0a1d69994499e940b94a00abd3177b35
SHA1

637233986ce89183ddc737213bc327c94d7fbaed
SHA256

4fe0f2dff88cf65771136b4a9c138b8d69ec3a7acd9937a6f8c976a1ed72a808
SHA512

c5093671ddb68cca60485810883546d54981d3564be508a5420321c6451504c20cbd278f4131e973bbf7e1fa4dc8ad5f9597bef1c502b196b52cd1b809a7c989
SSDEEP

1536:YGc/5PpTowbqwI81hDTlBSaDf3dlK+hiKbZXwwBk6u6ollvuAsyHlm:EhPmanP1hrSaDf3DZXDpu6olluyHlm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2916	2268	regsvr32.exe	28
PID 2268 wrote to memory of 2916	2268	regsvr32.exe	28
PID 2268 wrote to memory of 2916	2268	regsvr32.exe	28
PID 2268 wrote to memory of 2916	2268	regsvr32.exe	28
PID 2268 wrote to memory of 2916	2268	regsvr32.exe	28
PID 2268 wrote to memory of 2916	2268	regsvr32.exe	28
PID 2268 wrote to memory of 2916	2268	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0a1d69994499e940b94a00abd3177b35.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0a1d69994499e940b94a00abd3177b35.dll
  2⤵
  PID:2916