2c1cf07242aa782353a9102468b7242d25fc00191977073039be39d2868366b3

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:01

Target

096008f8402db5e19edf1dc3fcd7ae78.dll
Size

88KB
MD5

096008f8402db5e19edf1dc3fcd7ae78
SHA1

5845243d4759ecd7afed563285cb6b051204ddc1
SHA256

2c1cf07242aa782353a9102468b7242d25fc00191977073039be39d2868366b3
SHA512

73da42fb32b89ef011fcf78a305d0a2e3d1195e7d2d455f084db77438f5899be9dfc23f4d520f4376b54558a7f18bbc55446ac21f7fdd28905c461b315a6e41c
SSDEEP

1536:ITzakNQl4cqRkLGv7v/Nf/4y7QzRz0UeiISZiPNDasSgOGy7lwpeLGrt3CJDdKJE:ITOkkDqRkW7v/x4ykzV6ifkPNDxSgO/L

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1740	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1740	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1740	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1740	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1740	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1740	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1740	1684	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\096008f8402db5e19edf1dc3fcd7ae78.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\096008f8402db5e19edf1dc3fcd7ae78.dll
  2⤵
  PID:1740

memory/1740-0-0x0000000000470000-0x00000000004B3000-memory.dmp

Filesize
268KB

Download
memory/1740-1-0x0000000000470000-0x00000000004B3000-memory.dmp

Filesize
268KB

Download