e67023175255e66c1550346948cc5081ff4c6c69cf7fdd763cbfbdafd48895f8

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 18:40

Target

0c943b4eb92881e9486ba28162ab526b.dll
Size

302KB
MD5

0c943b4eb92881e9486ba28162ab526b
SHA1

a92c3984f9fd8167b82ebe349e55e5d6daa0580b
SHA256

e67023175255e66c1550346948cc5081ff4c6c69cf7fdd763cbfbdafd48895f8
SHA512

74e16139a9a99e528b95e126e232c8acefb363a8f167c3e27d3d3abf7260c925942cf591be505d791c6655aa431c7d3994aafd0c1f89e945818aae422362e76a
SSDEEP

6144:avPuuUlaf3Z9APWH/iCCi/XLJA348X/f38X/f38X/K3E:avmudTAPCqCCkXOI8X/f38X/f38X/K3E

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 3040	1244	regsvr32.exe	14
PID 1244 wrote to memory of 3040	1244	regsvr32.exe	14
PID 1244 wrote to memory of 3040	1244	regsvr32.exe	14
PID 1244 wrote to memory of 3040	1244	regsvr32.exe	14
PID 1244 wrote to memory of 3040	1244	regsvr32.exe	14
PID 1244 wrote to memory of 3040	1244	regsvr32.exe	14
PID 1244 wrote to memory of 3040	1244	regsvr32.exe	14

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\0c943b4eb92881e9486ba28162ab526b.dll
1⤵
PID:3040

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0c943b4eb92881e9486ba28162ab526b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1244