e01bb99eeb934a594d9128aabe01806fdeb9d6ecb907fd842701778ebaacfed6

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 20:44

Target

0381f48662f579531662141902d107ab.dll
Size

99KB
MD5

0381f48662f579531662141902d107ab
SHA1

5e49753a7994fcb7278ca59e637fe1688bf44b04
SHA256

e01bb99eeb934a594d9128aabe01806fdeb9d6ecb907fd842701778ebaacfed6
SHA512

3dee6e09860efab19f9f7679c179d565aeecb966263d6c9e3959d9b98245feccb448ac76b166c8c45d7e9bb04256bdc1342e55a3eb1820367fb17d5d07a2aad7
SSDEEP

1536:j5OSSgjoRSDzqImuitvLr0Lh7T2aRSjzM+3CXtDg+e+rkKIka1h1KPjnWOQd:j5dcOOrtDE5OzM+3C1Be+PY+yd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 1044	2540	regsvr32.exe	28
PID 2540 wrote to memory of 1044	2540	regsvr32.exe	28
PID 2540 wrote to memory of 1044	2540	regsvr32.exe	28
PID 2540 wrote to memory of 1044	2540	regsvr32.exe	28
PID 2540 wrote to memory of 1044	2540	regsvr32.exe	28
PID 2540 wrote to memory of 1044	2540	regsvr32.exe	28
PID 2540 wrote to memory of 1044	2540	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0381f48662f579531662141902d107ab.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0381f48662f579531662141902d107ab.dll
  2⤵
  PID:1044

memory/1044-0-0x0000000000200000-0x0000000000246000-memory.dmp

Filesize
280KB

Download
memory/1044-1-0x0000000000200000-0x0000000000246000-memory.dmp

Filesize
280KB

Download