88e1bfb47261141c91ce14007340f92209168bb6297caef10f9a1d5a11cba39a

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 00:29

Target

21c17b68d8be9a27620ce1368d2dae6f.dll
Size

80KB
MD5

21c17b68d8be9a27620ce1368d2dae6f
SHA1

d92f0a7d7ff54d08d66b541af95b0d0b2cb3f743
SHA256

88e1bfb47261141c91ce14007340f92209168bb6297caef10f9a1d5a11cba39a
SHA512

424d912ab16e901b394366559705c2b4901b116466115be2c5e7dd7813ad2cf38c6a2b507c747c2d6af68f3d9a08691fd8fabc988c9e499da81ccec3040294d7
SSDEEP

1536:qM7BuTE3mT7BAEI0gkrMKZGzJKw0tPrXTi450vvAAHImDAaOelxtlkGsdwd8j3eZ:PBwE3U7yipGzyXyvNoXaOIxtlkGwwG2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1316	2164	regsvr32.exe	28
PID 2164 wrote to memory of 1316	2164	regsvr32.exe	28
PID 2164 wrote to memory of 1316	2164	regsvr32.exe	28
PID 2164 wrote to memory of 1316	2164	regsvr32.exe	28
PID 2164 wrote to memory of 1316	2164	regsvr32.exe	28
PID 2164 wrote to memory of 1316	2164	regsvr32.exe	28
PID 2164 wrote to memory of 1316	2164	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\21c17b68d8be9a27620ce1368d2dae6f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\21c17b68d8be9a27620ce1368d2dae6f.dll
  2⤵
  PID:1316

memory/1316-0-0x0000000000170000-0x00000000001B1000-memory.dmp

Filesize
260KB

Download