cf156e4aff9719ccdffa2535316da0017a4172bd53218f43b650d24b3919f952

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:06

Target

00096185d742ea754e078d7b66f4c3cc.dll
Size

19KB
MD5

00096185d742ea754e078d7b66f4c3cc
SHA1

10202b8324400411d25febb7d5d53c701527ca90
SHA256

cf156e4aff9719ccdffa2535316da0017a4172bd53218f43b650d24b3919f952
SHA512

21833aa0554891c07d51f62f6dba4d0c9e476b27214fa011f2b5e3dc059c558520e2a459b3519445242582dba71b8abf0b09f6efecad6114fdaaec9bebc30b75
SSDEEP

384:LWWTEcWrVeO9PrCZFnFf+KagG2aXq1M37Lit1co6NqxiJxxHieP7zR1:k9oFnFWKal2P826NqEYeP7P

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1756	3028	regsvr32.exe	28
PID 3028 wrote to memory of 1756	3028	regsvr32.exe	28
PID 3028 wrote to memory of 1756	3028	regsvr32.exe	28
PID 3028 wrote to memory of 1756	3028	regsvr32.exe	28
PID 3028 wrote to memory of 1756	3028	regsvr32.exe	28
PID 3028 wrote to memory of 1756	3028	regsvr32.exe	28
PID 3028 wrote to memory of 1756	3028	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\00096185d742ea754e078d7b66f4c3cc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\00096185d742ea754e078d7b66f4c3cc.dll
  2⤵
  PID:1756

memory/1756-0-0x0000000000170000-0x000000000018D000-memory.dmp

Filesize
116KB

Download