ec7986556b6a0c1f9254a6b5fbbbd88ac2a7fd60d441d841246430ffaa5bab6b

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:27

Target

ec7986556b6a0c1f9254a6b5fbbbd88ac2a7fd60d441d841246430ffaa5bab6b.dll
Size

65KB
MD5

fc0eb1cc19244c4f0b4258ce8aeae8cb
SHA1

bd722ef3681382d90ab55b8646c5c09dcce22c68
SHA256

ec7986556b6a0c1f9254a6b5fbbbd88ac2a7fd60d441d841246430ffaa5bab6b
SHA512

3da45d3406b2798eae48a949583c977dec2bc0ed38e46624c1fd4a0aa90c08aa7be2f418a1d11339529d9e2bd8dea4af1bc913dadc97bfe1f75f4803ccc00c97
SSDEEP

1536:MVwJwbA8aLItMb1mIpn2JYVV3h24aWyOxtejbEwGZD:MVnbVtfIp2JYVp84PyOxt4st

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3052	2104	regsvr32.exe	28
PID 2104 wrote to memory of 3052	2104	regsvr32.exe	28
PID 2104 wrote to memory of 3052	2104	regsvr32.exe	28
PID 2104 wrote to memory of 3052	2104	regsvr32.exe	28
PID 2104 wrote to memory of 3052	2104	regsvr32.exe	28
PID 2104 wrote to memory of 3052	2104	regsvr32.exe	28
PID 2104 wrote to memory of 3052	2104	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ec7986556b6a0c1f9254a6b5fbbbd88ac2a7fd60d441d841246430ffaa5bab6b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ec7986556b6a0c1f9254a6b5fbbbd88ac2a7fd60d441d841246430ffaa5bab6b.dll
  2⤵
  PID:3052

memory/3052-0-0x0000000074FC0000-0x0000000074FDF000-memory.dmp

Filesize
124KB

Download