5827bcb8681dfea7f62e5194281e735cfde392a06c45f8bd53012dad5e3f31c3

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 22:48

Target

0613b276e8feb53860cd217e70b7914c.dll
Size

89KB
MD5

0613b276e8feb53860cd217e70b7914c
SHA1

7d99b42ee02cc9d4c69ab5f033f488cf3a7007e1
SHA256

5827bcb8681dfea7f62e5194281e735cfde392a06c45f8bd53012dad5e3f31c3
SHA512

8523cf378aac4e25be08d03b21cc1776939661aebdc8d9a3a818f06a463f89c77de10d8f4223aa1fdab0804a23a85fdda4cc7df07849cb1fd8e7f7773ee2c0f0
SSDEEP

1536:mVGjA0G1JqprXi963OcG9Is0tq25kPO0iyP6P6T2GxnrRZCwGTLvhf6uGut9Is0:mCM7qprXi9D76q+k/VlxrRZ8DGujS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2168	1440	regsvr32.exe	28
PID 1440 wrote to memory of 2168	1440	regsvr32.exe	28
PID 1440 wrote to memory of 2168	1440	regsvr32.exe	28
PID 1440 wrote to memory of 2168	1440	regsvr32.exe	28
PID 1440 wrote to memory of 2168	1440	regsvr32.exe	28
PID 1440 wrote to memory of 2168	1440	regsvr32.exe	28
PID 1440 wrote to memory of 2168	1440	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0613b276e8feb53860cd217e70b7914c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0613b276e8feb53860cd217e70b7914c.dll
  2⤵
  PID:2168

memory/2168-0-0x00000000001D0000-0x0000000000213000-memory.dmp

Filesize
268KB

Download
memory/2168-1-0x00000000001D0000-0x0000000000213000-memory.dmp

Filesize
268KB

Download