a845316b6355280c882fe8e97edb5e99ca429f3daf3457469e66f520ffcd4155

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 23:53

Target

07a77db1e31e7bb691a1b539d69161fc.dll
Size

88KB
MD5

07a77db1e31e7bb691a1b539d69161fc
SHA1

d310ad0853c2670e0c0b2db572c99d3b61c05d73
SHA256

a845316b6355280c882fe8e97edb5e99ca429f3daf3457469e66f520ffcd4155
SHA512

965fde293d33b085d1c17c22b429dd25b86f040613e85ae327dfe1604ca62be349f58f2285a5fd1ea1390caa46647c68de638c4308b4b3a8fa80d9f0ef3544fc
SSDEEP

1536:W28XlHvELCsFcSFhv3VjRkM8bZ/pI7UncxMA42Abp3jerK8tMfqZ5qqKaf6njN:W1Xl4cSFhv3VjRob10Li72uBjt8if86J

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1664	1672	regsvr32.exe	28
PID 1672 wrote to memory of 1664	1672	regsvr32.exe	28
PID 1672 wrote to memory of 1664	1672	regsvr32.exe	28
PID 1672 wrote to memory of 1664	1672	regsvr32.exe	28
PID 1672 wrote to memory of 1664	1672	regsvr32.exe	28
PID 1672 wrote to memory of 1664	1672	regsvr32.exe	28
PID 1672 wrote to memory of 1664	1672	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\07a77db1e31e7bb691a1b539d69161fc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\07a77db1e31e7bb691a1b539d69161fc.dll
  2⤵
  PID:1664

memory/1664-0-0x00000000001A0000-0x00000000001E3000-memory.dmp

Filesize
268KB

Download