8757725ac8d2024dd99687cca85d336e8dbee32eeaa51c18ef0dd80e78d08c6a

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:45

Target

18ebe87ede81c58c022eac9d550aa7f4.dll
Size

85KB
MD5

18ebe87ede81c58c022eac9d550aa7f4
SHA1

5418842602f51ada6e92442ed44825074a67c812
SHA256

8757725ac8d2024dd99687cca85d336e8dbee32eeaa51c18ef0dd80e78d08c6a
SHA512

18a171575f198abdcfee61e69317dfd0885669c41131fcb7c0d45220d465af01635315ae18c9d905073a0f562d918db7495b0f6031e9a77e6d25b254537b000e
SSDEEP

1536:r+6f89PTvVTVdKLgCCC8zCHX1aDw32oM4mcVoIbN12XXK2ywsQg:rdWPr934N3n3X/VoaYnK3DB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2056	2484	regsvr32.exe	28
PID 2484 wrote to memory of 2056	2484	regsvr32.exe	28
PID 2484 wrote to memory of 2056	2484	regsvr32.exe	28
PID 2484 wrote to memory of 2056	2484	regsvr32.exe	28
PID 2484 wrote to memory of 2056	2484	regsvr32.exe	28
PID 2484 wrote to memory of 2056	2484	regsvr32.exe	28
PID 2484 wrote to memory of 2056	2484	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\18ebe87ede81c58c022eac9d550aa7f4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\18ebe87ede81c58c022eac9d550aa7f4.dll
  2⤵
  PID:2056

memory/2056-0-0x0000000000570000-0x00000000005B3000-memory.dmp

Filesize
268KB

Download
memory/2056-1-0x0000000000570000-0x00000000005B3000-memory.dmp

Filesize
268KB

Download