43f26c6213f24898ac8a1f52ab6c12069fb48d0cb2a85261568a3bbc5d2897fd

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 16:46

Target

7dbe34b6efb438d285260e219c194bc9.dll
Size

112KB
MD5

7dbe34b6efb438d285260e219c194bc9
SHA1

7d07c209110ebff365368e5a09d91926db24d2c7
SHA256

43f26c6213f24898ac8a1f52ab6c12069fb48d0cb2a85261568a3bbc5d2897fd
SHA512

959970cc2b5947a1e9a173e681ffd789c3928ef90ad7ef45b1c94f8b60e26a2e6bf935096f9ac507714dcaa652627b21a67b8ae9d832e3c9cd29ee69512a7d39
SSDEEP

3072:PKMM0PcSQYTgefKPUb1ZsCjwbrv3KSWC57VxTlGy:SM50BYsef5h+GwbTZW+LTIy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2032	2960	regsvr32.exe	16
PID 2960 wrote to memory of 2032	2960	regsvr32.exe	16
PID 2960 wrote to memory of 2032	2960	regsvr32.exe	16
PID 2960 wrote to memory of 2032	2960	regsvr32.exe	16
PID 2960 wrote to memory of 2032	2960	regsvr32.exe	16
PID 2960 wrote to memory of 2032	2960	regsvr32.exe	16
PID 2960 wrote to memory of 2032	2960	regsvr32.exe	16

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7dbe34b6efb438d285260e219c194bc9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7dbe34b6efb438d285260e219c194bc9.dll
  2⤵
  PID:2032

memory/2032-0-0x0000000010000000-0x000000001008A000-memory.dmp

Filesize
552KB

Download
memory/2032-1-0x0000000010000000-0x000000001008A000-memory.dmp

Filesize
552KB

Download