293cfadfb9041240e89ba98bb6b135e50b877818c77b57512b29e94d957dba23

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 21:51

Target

1da05c2108741774ab1c91082171246a.dll
Size

96KB
MD5

1da05c2108741774ab1c91082171246a
SHA1

568b5202c6fe6305089f3a5e215ca22e5dc11b65
SHA256

293cfadfb9041240e89ba98bb6b135e50b877818c77b57512b29e94d957dba23
SHA512

3cd2847386850fc5d74086e686b34956860e76206557ddcb01b78b8cefc6203ffbcba918dc744c728913bb674272cc5164f402fa6299cfc4caece2040d6d35bc
SSDEEP

3072:fCy4dc6xEoqPr2Fj4lPZIVpBNJ9PAe2KYydxafuI:d4d3xJYr2Fj4pZIVpBZYe2nJT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1720	1936	regsvr32.exe	14
PID 1936 wrote to memory of 1720	1936	regsvr32.exe	14
PID 1936 wrote to memory of 1720	1936	regsvr32.exe	14
PID 1936 wrote to memory of 1720	1936	regsvr32.exe	14
PID 1936 wrote to memory of 1720	1936	regsvr32.exe	14
PID 1936 wrote to memory of 1720	1936	regsvr32.exe	14
PID 1936 wrote to memory of 1720	1936	regsvr32.exe	14

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1da05c2108741774ab1c91082171246a.dll
1⤵
PID:1720

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1da05c2108741774ab1c91082171246a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1936

memory/1720-0-0x0000000000190000-0x00000000001AE000-memory.dmp

Filesize
120KB

Download