8321cca827229ca13c5c2d33cc55011e3fe9b4a130edf373e49913ee60e1751e

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:18

Target

017c9fe41fbc7dda4ab9a2ce5017eeb6.dll
Size

91KB
MD5

017c9fe41fbc7dda4ab9a2ce5017eeb6
SHA1

ec029f8f471fed941a732de015af6b0a17340872
SHA256

8321cca827229ca13c5c2d33cc55011e3fe9b4a130edf373e49913ee60e1751e
SHA512

737c50da0d3484d49edb507274c6702f8d5c1f5b513fdcbea16693463bc2be2536ca343ed186edf373653c335de8a1558a3b3a2d4bf3640f8e5bad91841f083d
SSDEEP

1536:Is2XXMJQbu8v+44vSxuQFCvksWiLEfW9a9SOPeFdJRblTb3xgTmhV2Ooc4xm0U2N:Is2jipRAuQ/iLEfzyDrpTb33hEdc431j

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2092	2976	regsvr32.exe	28
PID 2976 wrote to memory of 2092	2976	regsvr32.exe	28
PID 2976 wrote to memory of 2092	2976	regsvr32.exe	28
PID 2976 wrote to memory of 2092	2976	regsvr32.exe	28
PID 2976 wrote to memory of 2092	2976	regsvr32.exe	28
PID 2976 wrote to memory of 2092	2976	regsvr32.exe	28
PID 2976 wrote to memory of 2092	2976	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\017c9fe41fbc7dda4ab9a2ce5017eeb6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\017c9fe41fbc7dda4ab9a2ce5017eeb6.dll
  2⤵
  PID:2092

memory/2092-0-0x00000000001B0000-0x00000000001F6000-memory.dmp

Filesize
280KB

Download