bdd76bb3b8e382db3a3d7a8da5ad3ba8be7e13ee66466280eb6c64a4924aeddf

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 23:27

Target

43306a6e59ad7e64fd64faf5c1681998.dll
Size

217KB
MD5

43306a6e59ad7e64fd64faf5c1681998
SHA1

97b645fce2a26a07ce51d0d565e654c3e3cd537b
SHA256

bdd76bb3b8e382db3a3d7a8da5ad3ba8be7e13ee66466280eb6c64a4924aeddf
SHA512

7394ea85f600127075cd0ab1193307d3114f00d6e9e60ad53540128e35dc853dc0fe4f5f4c993c9fb638601da67996a8dbf32980171fcd94a7e59a1aa24cbfcb
SSDEEP

6144:CrutjWerutjWerutjWerutjWerutjWerutjWerutjW:Crperperperperperperp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1988	1968	regsvr32.exe	28
PID 1968 wrote to memory of 1988	1968	regsvr32.exe	28
PID 1968 wrote to memory of 1988	1968	regsvr32.exe	28
PID 1968 wrote to memory of 1988	1968	regsvr32.exe	28
PID 1968 wrote to memory of 1988	1968	regsvr32.exe	28
PID 1968 wrote to memory of 1988	1968	regsvr32.exe	28
PID 1968 wrote to memory of 1988	1968	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\43306a6e59ad7e64fd64faf5c1681998.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\43306a6e59ad7e64fd64faf5c1681998.dll
  2⤵
  PID:1988

memory/1988-0-0x00000000000C0000-0x00000000000CD000-memory.dmp

Filesize
52KB

Download