9ad769984f40004fd9190c746f6e2847390cac1d634480257fd254db41802ada

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:48

Target

0eff7122800b817297693ddbba758906.dll
Size

80KB
MD5

0eff7122800b817297693ddbba758906
SHA1

4116c85f25d44771035627149c87b5c864f72c55
SHA256

9ad769984f40004fd9190c746f6e2847390cac1d634480257fd254db41802ada
SHA512

c8442296d1a5bc1eafc4fede08ddfd332c112aba6355ff6f1b2623b49f0db3481cbb8a1afc146b2931130ee58ae9d51ed5f6f0690022e8d0117315cb8ecda8c9
SSDEEP

1536:CBQ0Es8TbIuRv76LanhQGxGAQeVY0zqwzpbXLDF6gJxxQz:CBQ5s8TbIu1ianhQaQazqwzFn8gY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1280	2928	regsvr32.exe	28
PID 2928 wrote to memory of 1280	2928	regsvr32.exe	28
PID 2928 wrote to memory of 1280	2928	regsvr32.exe	28
PID 2928 wrote to memory of 1280	2928	regsvr32.exe	28
PID 2928 wrote to memory of 1280	2928	regsvr32.exe	28
PID 2928 wrote to memory of 1280	2928	regsvr32.exe	28
PID 2928 wrote to memory of 1280	2928	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0eff7122800b817297693ddbba758906.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0eff7122800b817297693ddbba758906.dll
  2⤵
  PID:1280

memory/1280-0-0x00000000001B0000-0x00000000001EE000-memory.dmp

Filesize
248KB

Download