da51f459dd008dd6fcb62ecdc7fe2b7c033fcdced47526c516804a4c4adeb7d8

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:09

Target

11cb1b6217b9f692e7bf65f5b1171999.dll
Size

86KB
MD5

11cb1b6217b9f692e7bf65f5b1171999
SHA1

e2cad246c58daf427884c11ab2aefab4f6f879f2
SHA256

da51f459dd008dd6fcb62ecdc7fe2b7c033fcdced47526c516804a4c4adeb7d8
SHA512

088d0861179ce9637be289f02e185b0070bc37abaaf7363618ce38fb2d9a6c7aa6831891f4eadadeb66d22579070c48dee01495b96ffe8fd2a982e92346d70f4
SSDEEP

1536:iJ0ZgcldlQ1/kbt+XSnrsduqDcg3NwZMAMndt2jSKsQF8gRdBafbUq1F/rS:SCgcPi1/kx+ina7aVMErsQFe44lG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 3048	2536	regsvr32.exe	28
PID 2536 wrote to memory of 3048	2536	regsvr32.exe	28
PID 2536 wrote to memory of 3048	2536	regsvr32.exe	28
PID 2536 wrote to memory of 3048	2536	regsvr32.exe	28
PID 2536 wrote to memory of 3048	2536	regsvr32.exe	28
PID 2536 wrote to memory of 3048	2536	regsvr32.exe	28
PID 2536 wrote to memory of 3048	2536	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\11cb1b6217b9f692e7bf65f5b1171999.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\11cb1b6217b9f692e7bf65f5b1171999.dll
  2⤵
  PID:3048

memory/3048-0-0x00000000001F0000-0x0000000000233000-memory.dmp

Filesize
268KB

Download