9a168220f3adac2609438f399a417b54352b89346853b8c32cdd8beef753abda

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:35

Target

049039743714a8bfb9e82d03e888e055.dll
Size

245KB
MD5

049039743714a8bfb9e82d03e888e055
SHA1

32f1b311f7fe6fc9e0c6cb56d9b7751ae3e8a2fd
SHA256

9a168220f3adac2609438f399a417b54352b89346853b8c32cdd8beef753abda
SHA512

6f09db558868cbfa76f2a8489bc8259a0507993485a750c6b5a5733ddd09b5fdba5fac261b1ebcd601fb7ba072bc5199bf09e38984eab53386034a7bff49e6bf
SSDEEP

3072:AaomidlGaomidlGaomidlGaomidlGaomidlGaomidlGaomidl:Ax/Sx/Sx/Sx/Sx/Sx/Sx/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2136	3044	regsvr32.exe	15
PID 3044 wrote to memory of 2136	3044	regsvr32.exe	15
PID 3044 wrote to memory of 2136	3044	regsvr32.exe	15
PID 3044 wrote to memory of 2136	3044	regsvr32.exe	15
PID 3044 wrote to memory of 2136	3044	regsvr32.exe	15
PID 3044 wrote to memory of 2136	3044	regsvr32.exe	15
PID 3044 wrote to memory of 2136	3044	regsvr32.exe	15

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\049039743714a8bfb9e82d03e888e055.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\049039743714a8bfb9e82d03e888e055.dll
  2⤵
  PID:2136

memory/2136-0-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download