cf344e56471ce8fcb11cd11953dd878dbfd4dd2d5a5b782f34210a23e6efeb9f

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:55

Target

3285f77c36cd013f4268b42ce99cc6f2.dll
Size

47KB
MD5

3285f77c36cd013f4268b42ce99cc6f2
SHA1

f147457544e32af6d09a80c45868fb1605aa92aa
SHA256

cf344e56471ce8fcb11cd11953dd878dbfd4dd2d5a5b782f34210a23e6efeb9f
SHA512

78daf38f649f990bf38e4f9486eab9e080765020f703f1b0b341432e9354cfbff703adfb4f463041b2438be92d12042ee8a27bbd13330afa51276e11ddeeb0d8
SSDEEP

768:tSVMqQCVaQkUwjWnobKaKOyiO5OpBlWb4TD/nIsC1IrwpPWxMHbQsu7c:MVMqFVaQb0KaKOyiGOpBlWbc+IrwpmIX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2252	2448	regsvr32.exe	18
PID 2448 wrote to memory of 2252	2448	regsvr32.exe	18
PID 2448 wrote to memory of 2252	2448	regsvr32.exe	18
PID 2448 wrote to memory of 2252	2448	regsvr32.exe	18
PID 2448 wrote to memory of 2252	2448	regsvr32.exe	18
PID 2448 wrote to memory of 2252	2448	regsvr32.exe	18
PID 2448 wrote to memory of 2252	2448	regsvr32.exe	18

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3285f77c36cd013f4268b42ce99cc6f2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3285f77c36cd013f4268b42ce99cc6f2.dll
  2⤵
  PID:2252

memory/2252-0-0x0000000000130000-0x0000000000141000-memory.dmp

Filesize
68KB

Download