14b49cfb2f9569dd6d84259362e9cce0e7d615eb30d1e10abbc224b8197d89d7

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:30

Target

122f4c1f2a7ffacf2a3fb7c3cf771a00.dll
Size

230KB
MD5

122f4c1f2a7ffacf2a3fb7c3cf771a00
SHA1

6986d9ded824d08ffdf9bef02392bb45dfc97253
SHA256

14b49cfb2f9569dd6d84259362e9cce0e7d615eb30d1e10abbc224b8197d89d7
SHA512

321ec6179be7b417aaf704be3efc513004613407df2d9a08a4ebfc55c4d1ace1d6bd6acd76c19bf932265b6f109553b7f7baa391e761da2df9536f706cf3f3cc
SSDEEP

3072:CR40TCOF6XGDu7as51V23YqpNefa29lDBszXwovkWFsto0umuVOAjMwajr6:M02au+/2kyOB/ocysuVOAj26

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2136	2396	regsvr32.exe	28
PID 2396 wrote to memory of 2136	2396	regsvr32.exe	28
PID 2396 wrote to memory of 2136	2396	regsvr32.exe	28
PID 2396 wrote to memory of 2136	2396	regsvr32.exe	28
PID 2396 wrote to memory of 2136	2396	regsvr32.exe	28
PID 2396 wrote to memory of 2136	2396	regsvr32.exe	28
PID 2396 wrote to memory of 2136	2396	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\122f4c1f2a7ffacf2a3fb7c3cf771a00.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\122f4c1f2a7ffacf2a3fb7c3cf771a00.dll
  2⤵
  PID:2136