bdc5dd259e5404b11be051a4d5acecd15d8cc8dc4a68adfb8bc3aec523023fb0

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 00:44

Target

1de070532dcc9e6171bb3bd9220794b8.dll
Size

116KB
MD5

1de070532dcc9e6171bb3bd9220794b8
SHA1

4d627397c645b8de082293efdec4c2dcb14a93a5
SHA256

bdc5dd259e5404b11be051a4d5acecd15d8cc8dc4a68adfb8bc3aec523023fb0
SHA512

e8463ed8def97a5d86ac34e2b50568ea25295f0f1922d01a27777a123ed5e47346aa122fea352f5447fef27ef84655ebcf2b62fdef265b331fada735b0ec1e81
SSDEEP

768:mPJXFQoiRqZOxQqSyoJoChjLs4l4I5jmQP/gCRWHJd0WFQpOKDzfpMalPpB59xHO:mBVQvRqZEQ1TNRrmpGOKvBzhB595ohH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2844	2008	regsvr32.exe	28
PID 2008 wrote to memory of 2844	2008	regsvr32.exe	28
PID 2008 wrote to memory of 2844	2008	regsvr32.exe	28
PID 2008 wrote to memory of 2844	2008	regsvr32.exe	28
PID 2008 wrote to memory of 2844	2008	regsvr32.exe	28
PID 2008 wrote to memory of 2844	2008	regsvr32.exe	28
PID 2008 wrote to memory of 2844	2008	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1de070532dcc9e6171bb3bd9220794b8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1de070532dcc9e6171bb3bd9220794b8.dll
  2⤵
  PID:2844

memory/2844-0-0x00000000001B0000-0x00000000001CD000-memory.dmp

Filesize
116KB

Download