f685dd97966ca0db14c417cd3719cc55aad196328303a95d3f896b582b7cf2b8

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 00:30

Target

089ebf549a54ffd47419754b2a4a1b47.dll
Size

85KB
MD5

089ebf549a54ffd47419754b2a4a1b47
SHA1

63150a78295cdf80445586d8e540fb8d10e51237
SHA256

f685dd97966ca0db14c417cd3719cc55aad196328303a95d3f896b582b7cf2b8
SHA512

0663a3ead6426768836e11bea0468356fad5672839a27653001ec279cfd15e5fb432ddf4dbaf5d7624e372c7ea73d74562dc0ac7754cce4baca717b654ec62be
SSDEEP

1536:lvMHPiWVXVug0qZz3Ud7MzUwJlN3Pw8el467YbwBHq0sS9k4rk7TzrEm73L7jrVd:iaS0g0qZzkhgjlU4vbwBHQuPkfvEevmk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3052	2104	regsvr32.exe	16
PID 2104 wrote to memory of 3052	2104	regsvr32.exe	16
PID 2104 wrote to memory of 3052	2104	regsvr32.exe	16
PID 2104 wrote to memory of 3052	2104	regsvr32.exe	16
PID 2104 wrote to memory of 3052	2104	regsvr32.exe	16
PID 2104 wrote to memory of 3052	2104	regsvr32.exe	16
PID 2104 wrote to memory of 3052	2104	regsvr32.exe	16

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\089ebf549a54ffd47419754b2a4a1b47.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\089ebf549a54ffd47419754b2a4a1b47.dll
  2⤵
  PID:3052

memory/3052-0-0x0000000000240000-0x0000000000283000-memory.dmp

Filesize
268KB

Download