624ba57aa44234177d9f7c5bbaaa9ae266b3fcc9fd68ca069daa165e02c29d6d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 19:57

Target

0f465b7b2482625258ee953bcdb31422.dll
Size

590KB
MD5

0f465b7b2482625258ee953bcdb31422
SHA1

cb649f87fd89c8ea0523b4738c2eb7889b047687
SHA256

624ba57aa44234177d9f7c5bbaaa9ae266b3fcc9fd68ca069daa165e02c29d6d
SHA512

2df83343d9fe2f9ca2ce4dda943dbaf0cd622652b85d2735594922243947d769fcf1aa8dca6a93b1c2f014220cf44807576c2cdfa5aa7ca8bf516c114f853267
SSDEEP

12288:6DYjDYjDYjDYjDYjDYjDYjDYjDYjDYjDYjDYjDYjDYjDYjDYjDYjDYjDYY:pIIIIIIIIIIIIIIIIIIY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2928	2912	regsvr32.exe	28
PID 2912 wrote to memory of 2928	2912	regsvr32.exe	28
PID 2912 wrote to memory of 2928	2912	regsvr32.exe	28
PID 2912 wrote to memory of 2928	2912	regsvr32.exe	28
PID 2912 wrote to memory of 2928	2912	regsvr32.exe	28
PID 2912 wrote to memory of 2928	2912	regsvr32.exe	28
PID 2912 wrote to memory of 2928	2912	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0f465b7b2482625258ee953bcdb31422.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0f465b7b2482625258ee953bcdb31422.dll
  2⤵
  PID:2928

memory/2928-0-0x0000000000170000-0x000000000017E000-memory.dmp

Filesize
56KB

Download