6e13a8990644cad5ca462f66d84e9f9c6b4d9c3f28b68f5d573aea1d292cdab2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 06:36

Target

59fea93765dac36414af56c497bf364f.dll
Size

860KB
MD5

59fea93765dac36414af56c497bf364f
SHA1

19950f71371cf6d8bc3b8f5597f872624a380c78
SHA256

6e13a8990644cad5ca462f66d84e9f9c6b4d9c3f28b68f5d573aea1d292cdab2
SHA512

ace8690be8dc7658423edc4e0285945794a20c29d0410af451d296eb5230a35fe90523a65b527ddcc0cddd746316a8e471165727118104314a69f9eae2222676
SSDEEP

12288:sO/GmLCNg66nsDDeqBlNLTFDUDNfpTMoZSb4mRmHA:VGmLCNg6qsbnRUDNBT5a/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2220	2668	regsvr32.exe	28
PID 2668 wrote to memory of 2220	2668	regsvr32.exe	28
PID 2668 wrote to memory of 2220	2668	regsvr32.exe	28
PID 2668 wrote to memory of 2220	2668	regsvr32.exe	28
PID 2668 wrote to memory of 2220	2668	regsvr32.exe	28
PID 2668 wrote to memory of 2220	2668	regsvr32.exe	28
PID 2668 wrote to memory of 2220	2668	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\59fea93765dac36414af56c497bf364f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\59fea93765dac36414af56c497bf364f.dll
  2⤵
  PID:2220