2bcb72b85a68b49b9afefff5ab81dd235ac20345f2911de3a4b9262ace2a3e30

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:55

Target

1f1cfff4246017051bae2e1cdd8bd1f5.dll
Size

158KB
MD5

1f1cfff4246017051bae2e1cdd8bd1f5
SHA1

62e97847ca1d56434caedc462c4342901ec39c92
SHA256

2bcb72b85a68b49b9afefff5ab81dd235ac20345f2911de3a4b9262ace2a3e30
SHA512

bffcccd9d5b97788246330d9b216e2c330c19bd3932bb9bb1a66befe4d32276cdb6ff5deab14d56382a4616e8abecd43c7e445477be5058feee19aa19aaedf07
SSDEEP

1536:EYARVLqy5VncDXV34Mgsz4rbaZo5lXoUn/Bn8xg5iWqUPmNDQhRRTGjb0Kq/:EYUL5VcxkszUbt//B8xd9xqEjb0P

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 1624	2644	regsvr32.exe	28
PID 2644 wrote to memory of 1624	2644	regsvr32.exe	28
PID 2644 wrote to memory of 1624	2644	regsvr32.exe	28
PID 2644 wrote to memory of 1624	2644	regsvr32.exe	28
PID 2644 wrote to memory of 1624	2644	regsvr32.exe	28
PID 2644 wrote to memory of 1624	2644	regsvr32.exe	28
PID 2644 wrote to memory of 1624	2644	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1f1cfff4246017051bae2e1cdd8bd1f5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1f1cfff4246017051bae2e1cdd8bd1f5.dll
  2⤵
  PID:1624

memory/1624-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download