c130e6d5c8698e7390a2288a296881fbebf9458cca4f4629171f1d50afc64ef8

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:55

Target

04ee895a74b038e693998bb87e154508.dll
Size

90KB
MD5

04ee895a74b038e693998bb87e154508
SHA1

2d27a979a08cdb5862abce18dae197651992d6ba
SHA256

c130e6d5c8698e7390a2288a296881fbebf9458cca4f4629171f1d50afc64ef8
SHA512

4bf2f0413bed51c5a5a1634825e134e1b8971ed901da174119fd27fce67633e70290b1ed9520dc788d0632e15c98017086b18dbce9c26ee9c527b6bcc86318c7
SSDEEP

1536:YaOWqfXFStlTV9fp7YxzwSkaT8ynDPa6Npf5zQFsyscNM/11StqtmPxI0/GuhjSE:YaOWAFSfV9fRwtrDPVpUA1StLG0/jcE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2448	2460	regsvr32.exe	27
PID 2460 wrote to memory of 2448	2460	regsvr32.exe	27
PID 2460 wrote to memory of 2448	2460	regsvr32.exe	27
PID 2460 wrote to memory of 2448	2460	regsvr32.exe	27
PID 2460 wrote to memory of 2448	2460	regsvr32.exe	27
PID 2460 wrote to memory of 2448	2460	regsvr32.exe	27
PID 2460 wrote to memory of 2448	2460	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\04ee895a74b038e693998bb87e154508.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\04ee895a74b038e693998bb87e154508.dll
  2⤵
  PID:2448

memory/2448-0-0x00000000008E0000-0x0000000000926000-memory.dmp

Filesize
280KB

Download
memory/2448-1-0x00000000008E0000-0x0000000000926000-memory.dmp

Filesize
280KB

Download