34d3a0ce3112caf98e90fb9b2964f57c221b0f42309fde4a61d9d342fbed150b

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 22:27

Target

400df841a2944a12df98cdbcbf49535b.dll
Size

588KB
MD5

400df841a2944a12df98cdbcbf49535b
SHA1

b97c73ba28403665bbfa19ef3f38a3a61cfc83b3
SHA256

34d3a0ce3112caf98e90fb9b2964f57c221b0f42309fde4a61d9d342fbed150b
SHA512

32f67ed2a0e779642ac7d6fa13949da6685fbf3862cac2c6ad85741c26997ca71ef60ade31dfe53a0921a5d485236dee22cbb409b7ec53a0e8f74003ae373194
SSDEEP

1536:sYUge0rTC2tOmXbJVaK3R0XMJ33iU5hVXl7NeLZ61due6moMNNlltdgHXTzHrz0k:NZTOubqoNNfor

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2904	2756	regsvr32.exe	28
PID 2756 wrote to memory of 2904	2756	regsvr32.exe	28
PID 2756 wrote to memory of 2904	2756	regsvr32.exe	28
PID 2756 wrote to memory of 2904	2756	regsvr32.exe	28
PID 2756 wrote to memory of 2904	2756	regsvr32.exe	28
PID 2756 wrote to memory of 2904	2756	regsvr32.exe	28
PID 2756 wrote to memory of 2904	2756	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\400df841a2944a12df98cdbcbf49535b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\400df841a2944a12df98cdbcbf49535b.dll
  2⤵
  PID:2904

memory/2904-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download