6e8935d986f0f6151abfa628e868216101ffa611716ea3d5e5739be21938635f

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 07:33

Target

5ccfba80e14ab6cf21a134a1d53d0d19.dll
Size

3.5MB
MD5

5ccfba80e14ab6cf21a134a1d53d0d19
SHA1

13f2895004dfa8724e37239e3de18e3826f189df
SHA256

6e8935d986f0f6151abfa628e868216101ffa611716ea3d5e5739be21938635f
SHA512

a05d51f5ebf1e7c923ee16ae1a662509ec7ef3d0387af3af9a55dfd19a0e3637069491aee374f1b7f1a177ff8e7a0745f172c8cd446e52c7e20ff1e4366a007a
SSDEEP

49152:BcD03QmKka3ANmnlPesf0rIFA+qge6GIz1QlroeafKBZDAW1SvNTJqRlM:93dKkawNE2sf0rIFAt36G65W1lRm

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2220	3060	regsvr32.exe	28
PID 3060 wrote to memory of 2220	3060	regsvr32.exe	28
PID 3060 wrote to memory of 2220	3060	regsvr32.exe	28
PID 3060 wrote to memory of 2220	3060	regsvr32.exe	28
PID 3060 wrote to memory of 2220	3060	regsvr32.exe	28
PID 3060 wrote to memory of 2220	3060	regsvr32.exe	28
PID 3060 wrote to memory of 2220	3060	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5ccfba80e14ab6cf21a134a1d53d0d19.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5ccfba80e14ab6cf21a134a1d53d0d19.dll
  2⤵
  PID:2220