c2603901843b4cccde0c0cb0b830a7383b1ad10ef676042f284b762a5bad6c04

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:08

Target

0144c648c635d1056ff53686778923d6.dll
Size

144KB
MD5

0144c648c635d1056ff53686778923d6
SHA1

0104befe42ef9d14a6172a206efcdc44a5464965
SHA256

c2603901843b4cccde0c0cb0b830a7383b1ad10ef676042f284b762a5bad6c04
SHA512

80d3c84ae06875e3ab23148ad6977e2cc7ff113d106f6d6df733c74e664c1bd5f178ee18c8f6ca1e1810e7b05c862253bff2e6e3797990f7891fc6f9a95b150e
SSDEEP

1536:EEW1NLl7g7eyhLQk9jcnIMLTwp3sp40vcGLyyiIifXls2iymON:4Ll7g7exSjo/Y2vcrOifO7EN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2316	2196	regsvr32.exe	28
PID 2196 wrote to memory of 2316	2196	regsvr32.exe	28
PID 2196 wrote to memory of 2316	2196	regsvr32.exe	28
PID 2196 wrote to memory of 2316	2196	regsvr32.exe	28
PID 2196 wrote to memory of 2316	2196	regsvr32.exe	28
PID 2196 wrote to memory of 2316	2196	regsvr32.exe	28
PID 2196 wrote to memory of 2316	2196	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0144c648c635d1056ff53686778923d6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0144c648c635d1056ff53686778923d6.dll
  2⤵
  PID:2316

memory/2316-0-0x00000000001A0000-0x00000000001F3000-memory.dmp

Filesize
332KB

Download