d3cf82f6bfed58aed4a45ea540408d6a2b654a0b11d671c27bb0e39e3429b587

Analysis

max time kernel
22s
max time network
21s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:38

Target

20429468db610036c9df77dce7d69b77.dll
Size

30KB
MD5

20429468db610036c9df77dce7d69b77
SHA1

4556a709d039f8e9e010bd612030e408e6f2a778
SHA256

d3cf82f6bfed58aed4a45ea540408d6a2b654a0b11d671c27bb0e39e3429b587
SHA512

a122c0d0ea016f77cebe2f34d7fabc6194a9ce38d18fe988a324b69bfdf2ff3ee5d722f181294758f773d102e88aa230d9251084dac9a48ac19499c16d3a4075
SSDEEP

384:QNNe06t9hch4dV/X0hHujwY6DW1U7Z2YSN+V+apMBcKKSIUyCxlRQ8WIHZse:oeP9hN/6S11LNotMBQpgRnWw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 532	2476	regsvr32.exe	19
PID 2476 wrote to memory of 532	2476	regsvr32.exe	19
PID 2476 wrote to memory of 532	2476	regsvr32.exe	19
PID 2476 wrote to memory of 532	2476	regsvr32.exe	19
PID 2476 wrote to memory of 532	2476	regsvr32.exe	19
PID 2476 wrote to memory of 532	2476	regsvr32.exe	19
PID 2476 wrote to memory of 532	2476	regsvr32.exe	19

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\20429468db610036c9df77dce7d69b77.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\20429468db610036c9df77dce7d69b77.dll
  2⤵
  PID:532

memory/532-0-0x0000000000130000-0x000000000013D000-memory.dmp

Filesize
52KB

Download