020682fc7856488aa89ce1d0aec7be8cb14829ff34353b608e189568839c1bb4

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 11:38

Target

SmartDataRecovery/SmartDataRecovery.dll
Size

52KB
MD5

66c92333652f2d360c2452df32ed5b2e
SHA1

1d184696871c932d508f16d75b865e0825a6d59f
SHA256

cf42ef48532f797b9747cb03010890a21cc455bdc399a9daf3280d9d45b27a0d
SHA512

a53e3d3024941f2c0cb5ff5c650b5dc77c69f1f1626d11815011a74483b632e44a71bf41f4099a2bd6b808df987e38029ec56de8c3c57edb85a0bf4cc617013e
SSDEEP

384:6WNNgJdY59tTulkbETxYpx6y2LfiqoYBUcz837yIYh9JzxovS1f2uUIiho38oVee:BIwTulXtkmfZBe7EtFovs2I38oOSihb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2128	2036	regsvr32.exe	28
PID 2036 wrote to memory of 2128	2036	regsvr32.exe	28
PID 2036 wrote to memory of 2128	2036	regsvr32.exe	28
PID 2036 wrote to memory of 2128	2036	regsvr32.exe	28
PID 2036 wrote to memory of 2128	2036	regsvr32.exe	28
PID 2036 wrote to memory of 2128	2036	regsvr32.exe	28
PID 2036 wrote to memory of 2128	2036	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SmartDataRecovery\SmartDataRecovery.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\SmartDataRecovery\SmartDataRecovery.dll
  2⤵
  PID:2128