5a9124182bc46f8683cffb91a2e21c0cb504ce450afa5dba29b7e2682e6b56c5

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:52

Target

024d64849e8c1ce328f06b7fc3a523fe.dll
Size

224KB
MD5

024d64849e8c1ce328f06b7fc3a523fe
SHA1

9179458ec63b7d6dc29ad69e0f3386d97a7cf1bc
SHA256

5a9124182bc46f8683cffb91a2e21c0cb504ce450afa5dba29b7e2682e6b56c5
SHA512

8b3802ac1fa34602edc1294a864b1930a8d43556983f6e11c83e0c31110f429b7ddac968f79c3beddf1fddb76492b82f27ecf2f5ef6cdd5e28fabbd01e59b065
SSDEEP

3072:s4HVCU4HVCU4HVCU4HVCU4HVCU4HVCU4HVC:HHVCPHVCPHVCPHVCPHVCPHVCPHVC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2916	3048	regsvr32.exe	28
PID 3048 wrote to memory of 2916	3048	regsvr32.exe	28
PID 3048 wrote to memory of 2916	3048	regsvr32.exe	28
PID 3048 wrote to memory of 2916	3048	regsvr32.exe	28
PID 3048 wrote to memory of 2916	3048	regsvr32.exe	28
PID 3048 wrote to memory of 2916	3048	regsvr32.exe	28
PID 3048 wrote to memory of 2916	3048	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\024d64849e8c1ce328f06b7fc3a523fe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\024d64849e8c1ce328f06b7fc3a523fe.dll
  2⤵
  PID:2916

memory/2916-0-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download