363b2c1ad6ee6d70d148da387e8f7938f7ebb5af36c6d7dd450bfdbf32558bd5

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 18:04

Target

000017d67b51c59dafbc86549d1650fe.dll
Size

17KB
MD5

000017d67b51c59dafbc86549d1650fe
SHA1

e904184992006818ed1f65fdee94eebf186f50a3
SHA256

363b2c1ad6ee6d70d148da387e8f7938f7ebb5af36c6d7dd450bfdbf32558bd5
SHA512

4cf62385a32b1e0ebb3eb57217f5e5d137066386e06c903c0efd527f9ae7e3c934d10e25fd014eb9127dd9a05ba57fed9e21dc106d00dc1b0c706eb18f528a71
SSDEEP

384:QNWWTEcW4HSUm45Nf9J3PKz0hCcTlZN3T2j1gLTWkoO8hx1Rd1ocYdI:tqjm45piz0hPb12KLTWkshJvo6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2984	2056	regsvr32.exe	28
PID 2056 wrote to memory of 2984	2056	regsvr32.exe	28
PID 2056 wrote to memory of 2984	2056	regsvr32.exe	28
PID 2056 wrote to memory of 2984	2056	regsvr32.exe	28
PID 2056 wrote to memory of 2984	2056	regsvr32.exe	28
PID 2056 wrote to memory of 2984	2056	regsvr32.exe	28
PID 2056 wrote to memory of 2984	2056	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\000017d67b51c59dafbc86549d1650fe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\000017d67b51c59dafbc86549d1650fe.dll
  2⤵
  PID:2984

memory/2984-0-0x0000000000170000-0x000000000018B000-memory.dmp

Filesize
108KB

Download