7c52f8c6215caf91a76c3406bf282f3f4c2ddb115752b67ac366c9babac1a0bd

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:46

Target

08ffc9563045195d66f323c93b2a5148.dll
Size

43KB
MD5

08ffc9563045195d66f323c93b2a5148
SHA1

5f00475514de6fed95167b1bb3300dc48dc0adda
SHA256

7c52f8c6215caf91a76c3406bf282f3f4c2ddb115752b67ac366c9babac1a0bd
SHA512

2bc62777651464a84ec03d284d1a92614478cde0c35ea60d3f26a315c6985857a566138bd4302cb8fc4db69eb5df768564ab01424a6a5c9bb002fd97a1c25f15
SSDEEP

768:tCSqWQ1geCiG7LrpbCTiO5OpBl3JX+SsG8fB4ZEU8BSQcTgpoPx4qSfN:8SqWQGP7LrpuTiGOpBl3ESs9B4ZEUWjb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 3036	1880	regsvr32.exe	28
PID 1880 wrote to memory of 3036	1880	regsvr32.exe	28
PID 1880 wrote to memory of 3036	1880	regsvr32.exe	28
PID 1880 wrote to memory of 3036	1880	regsvr32.exe	28
PID 1880 wrote to memory of 3036	1880	regsvr32.exe	28
PID 1880 wrote to memory of 3036	1880	regsvr32.exe	28
PID 1880 wrote to memory of 3036	1880	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\08ffc9563045195d66f323c93b2a5148.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\08ffc9563045195d66f323c93b2a5148.dll
  2⤵
  PID:3036

memory/3036-0-0x0000000000470000-0x0000000000480000-memory.dmp

Filesize
64KB

Download