e51134b29bd21386332be947e7754851560dd7d9b5e78457c22d4fa558d0ffed

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 02:37

Target

005d979046b1feaca2a88491c8c648e2.dll
Size

452KB
MD5

005d979046b1feaca2a88491c8c648e2
SHA1

7671bb9e81911675b51cfa042e989b1bf736958a
SHA256

e51134b29bd21386332be947e7754851560dd7d9b5e78457c22d4fa558d0ffed
SHA512

5b336acbd5ca33e7246ad83fa3882b8fb18ecad941a78052b17184b66751cf4aff8bbac68206658c0fccef599a19a4026e20d41c1138efea80d58ee1377ead97
SSDEEP

12288:RpsGQ0bftxgEoAsxMpM3QSxFwj8KHYq2IRGkwwDfZ9MBs+ce:Rxbft/olxomXEGkwIfZ9My+B

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1720	2096	regsvr32.exe	28
PID 2096 wrote to memory of 1720	2096	regsvr32.exe	28
PID 2096 wrote to memory of 1720	2096	regsvr32.exe	28
PID 2096 wrote to memory of 1720	2096	regsvr32.exe	28
PID 2096 wrote to memory of 1720	2096	regsvr32.exe	28
PID 2096 wrote to memory of 1720	2096	regsvr32.exe	28
PID 2096 wrote to memory of 1720	2096	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\005d979046b1feaca2a88491c8c648e2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\005d979046b1feaca2a88491c8c648e2.dll
  2⤵
  PID:1720

memory/1720-0-0x0000000001E60000-0x0000000001FDF000-memory.dmp

Filesize
1.5MB

Download
memory/1720-1-0x0000000001E60000-0x0000000001FDF000-memory.dmp

Filesize
1.5MB

Download