82f34aade1d6e228e3eaafbae3b0f20b020f6b4dd26746e31a25d08cb885a863

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:39

Target

02032d97448113c8f8b9d1025481c8bb.dll
Size

85KB
MD5

02032d97448113c8f8b9d1025481c8bb
SHA1

405bf9343a5937233d0f7e47e3b17d17a1ec1615
SHA256

82f34aade1d6e228e3eaafbae3b0f20b020f6b4dd26746e31a25d08cb885a863
SHA512

15a1bffe8e76f75e10389c7a56f70012baa547654fce31fd9bd78c14c963921fd02049c86867878956246dfa11a08c03bb99a5c93c4b7580dd3620fb498b1658
SSDEEP

1536:3ZmZZ4B5f8HbGYUoFd2ywBt76L4t9hwtOAFs/wfJehPgws5Odr6kvt4acEAe76V:3oZ2f82oFd29h6ohwtOY4wUPgVm/cED4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2404	2652	regsvr32.exe	28
PID 2652 wrote to memory of 2404	2652	regsvr32.exe	28
PID 2652 wrote to memory of 2404	2652	regsvr32.exe	28
PID 2652 wrote to memory of 2404	2652	regsvr32.exe	28
PID 2652 wrote to memory of 2404	2652	regsvr32.exe	28
PID 2652 wrote to memory of 2404	2652	regsvr32.exe	28
PID 2652 wrote to memory of 2404	2652	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\02032d97448113c8f8b9d1025481c8bb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\02032d97448113c8f8b9d1025481c8bb.dll
  2⤵
  PID:2404

memory/2404-0-0x0000000000160000-0x00000000001A3000-memory.dmp

Filesize
268KB

Download