9ad62732fcc8d4fe8987f5b8a43a88ce2caade7defc97b7380ae4b3413dffc2b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:30

Target

05a45fae15c54354c561807ca14b56b3.dll
Size

22KB
MD5

05a45fae15c54354c561807ca14b56b3
SHA1

4f167695c4c92d8c678d5d19dfb1ec486d32dbf9
SHA256

9ad62732fcc8d4fe8987f5b8a43a88ce2caade7defc97b7380ae4b3413dffc2b
SHA512

5f9787cb954ff2e84710a314e44c93c640491d3857e0ed80c998f236ea4cc2661d8b7297238b2da68017c3f60d992a6c3f8e93286358aadd54981671832f4660
SSDEEP

384:CWeHd2vDIdFJG98WDq/Z5EEE8X/dY8TG40pKx7CSRgQZpzIzRpyTEcGmdmUGYYz:A924sChRlu/npKx+SRgQZBqpyTEZm7GF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2264	1336	regsvr32.exe	16
PID 1336 wrote to memory of 2264	1336	regsvr32.exe	16
PID 1336 wrote to memory of 2264	1336	regsvr32.exe	16
PID 1336 wrote to memory of 2264	1336	regsvr32.exe	16
PID 1336 wrote to memory of 2264	1336	regsvr32.exe	16
PID 1336 wrote to memory of 2264	1336	regsvr32.exe	16
PID 1336 wrote to memory of 2264	1336	regsvr32.exe	16

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\05a45fae15c54354c561807ca14b56b3.dll
1⤵
PID:2264

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\05a45fae15c54354c561807ca14b56b3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1336

memory/2264-1-0x0000000000350000-0x000000000036B000-memory.dmp

Filesize
108KB

Download
memory/2264-0-0x0000000000350000-0x000000000036B000-memory.dmp

Filesize
108KB

Download