883d2f00e726688b9677eac1fd208e3679b25a8aa0801e1cd39481521839b388

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 21:43

Target

fa2ebd6dbcd722fab9c956b498902fe1.dll
Size

120KB
MD5

fa2ebd6dbcd722fab9c956b498902fe1
SHA1

e2e607ccd55e868b89c604b467692175310d35a7
SHA256

883d2f00e726688b9677eac1fd208e3679b25a8aa0801e1cd39481521839b388
SHA512

678cdb33eaa1d9db1e895096ade27b33b799e13a89538283ff900381de8fc1d4fdf1308042588e2c6c12c87a42c0c2756bade170341c166c571098f0ec7ecbbe
SSDEEP

768:Xy5q4QGnoI2PHJdvrGFT72G3qnZ/lJzgr9rqQD+AfqkQwEANiBqCXpyN:i5q4QctGTe7O/PUrrD+Sq+gqCXpyN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2632	2508	regsvr32.exe	28
PID 2508 wrote to memory of 2632	2508	regsvr32.exe	28
PID 2508 wrote to memory of 2632	2508	regsvr32.exe	28
PID 2508 wrote to memory of 2632	2508	regsvr32.exe	28
PID 2508 wrote to memory of 2632	2508	regsvr32.exe	28
PID 2508 wrote to memory of 2632	2508	regsvr32.exe	28
PID 2508 wrote to memory of 2632	2508	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fa2ebd6dbcd722fab9c956b498902fe1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fa2ebd6dbcd722fab9c956b498902fe1.dll
  2⤵
  PID:2632

memory/2632-0-0x0000000000180000-0x000000000019E000-memory.dmp

Filesize
120KB

Download