18001a5de9b1be31fa0e8c10b9a37483b42575430158576f84a43c6e4f936c32

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 21:35

Target

0493bdc9e46741fdc361f2953a8a4f07.dll
Size

45KB
MD5

0493bdc9e46741fdc361f2953a8a4f07
SHA1

e5dfb70559a31c3b329b175206277c2f8112b3d5
SHA256

18001a5de9b1be31fa0e8c10b9a37483b42575430158576f84a43c6e4f936c32
SHA512

e9fa7611cd1c3cb62f0114b66d724f01ff66669250cdcc46a5f7f4621768e65d5ee5422390c97c7b8ef748596550476fc5e6f953b2d74f3e4d782f9974d9000d
SSDEEP

768:aDCSqWQ1geCiGgLTqiY8eOa/iO5OpBlmfrJQzAXZ3QGEVrSToSxVHxiS:amSqWQGPgLTqiTa/iGOpBlmcAJ3QGQrS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 1784	2956	regsvr32.exe	28
PID 2956 wrote to memory of 1784	2956	regsvr32.exe	28
PID 2956 wrote to memory of 1784	2956	regsvr32.exe	28
PID 2956 wrote to memory of 1784	2956	regsvr32.exe	28
PID 2956 wrote to memory of 1784	2956	regsvr32.exe	28
PID 2956 wrote to memory of 1784	2956	regsvr32.exe	28
PID 2956 wrote to memory of 1784	2956	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0493bdc9e46741fdc361f2953a8a4f07.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0493bdc9e46741fdc361f2953a8a4f07.dll
  2⤵
  PID:1784

memory/1784-0-0x00000000000C0000-0x00000000000D0000-memory.dmp

Filesize
64KB

Download