07a016a938933c766757ec5323b324e3b2ff121a5ad2036aaac934c0fd3b3d60

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:09

Target

0c8bda223c26995728a8963d1ee16b4e.dll
Size

88KB
MD5

0c8bda223c26995728a8963d1ee16b4e
SHA1

93fe61bb9065f0c1152ba39dcaf9a0ec474c7d0f
SHA256

07a016a938933c766757ec5323b324e3b2ff121a5ad2036aaac934c0fd3b3d60
SHA512

fd8b7660864e7e4a6dc7403845fdb23e00bfd1d440a4f88766880355f08ef71d17141ef41d3ccff923947df0bde768da6fc9008f555f2bbc42ab7130db280f70
SSDEEP

1536:rvjPaYYOaWdrDfcexxHdc+BjCtZFhCcG2BpUCi02QczJroOLuMze/NpxIshHS:rbPDjXffcWHlBWtThZBpU5oQuyefCshy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 2572	1312	regsvr32.exe	28
PID 1312 wrote to memory of 2572	1312	regsvr32.exe	28
PID 1312 wrote to memory of 2572	1312	regsvr32.exe	28
PID 1312 wrote to memory of 2572	1312	regsvr32.exe	28
PID 1312 wrote to memory of 2572	1312	regsvr32.exe	28
PID 1312 wrote to memory of 2572	1312	regsvr32.exe	28
PID 1312 wrote to memory of 2572	1312	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0c8bda223c26995728a8963d1ee16b4e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0c8bda223c26995728a8963d1ee16b4e.dll
  2⤵
  PID:2572

memory/2572-0-0x0000000000280000-0x00000000002C3000-memory.dmp

Filesize
268KB

Download