008ee5ba56b17b878f061bf22f16a4b84e95984ca4006b8344e422ec11bbb7fe

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:44

Target

0c127f7e3cc6b9b4b0577fd43176394d.dll
Size

117KB
MD5

0c127f7e3cc6b9b4b0577fd43176394d
SHA1

bd8b349d17934e43c8523c8aa33401b88b08fc91
SHA256

008ee5ba56b17b878f061bf22f16a4b84e95984ca4006b8344e422ec11bbb7fe
SHA512

d76b1b9c2f8cdf38b01febabf905ac5023d720adbc5669f6e4fd7d89802d730f2992791922677e456d7497576875d0769b9aaf74275bc69f1a2c66086a7e638a
SSDEEP

3072:PQx+UbCsinSomEN803/IuSNHUiyohXnPR1SCG0MKiy0916RbeR:5iqyEN80sHUVoJnSr5yes0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 832	2344	regsvr32.exe	28
PID 2344 wrote to memory of 832	2344	regsvr32.exe	28
PID 2344 wrote to memory of 832	2344	regsvr32.exe	28
PID 2344 wrote to memory of 832	2344	regsvr32.exe	28
PID 2344 wrote to memory of 832	2344	regsvr32.exe	28
PID 2344 wrote to memory of 832	2344	regsvr32.exe	28
PID 2344 wrote to memory of 832	2344	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0c127f7e3cc6b9b4b0577fd43176394d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0c127f7e3cc6b9b4b0577fd43176394d.dll
  2⤵
  PID:832

memory/832-0-0x0000000000250000-0x00000000002B6000-memory.dmp

Filesize
408KB

Download
memory/832-1-0x0000000000250000-0x00000000002B6000-memory.dmp

Filesize
408KB

Download