f011f4318cda72c936d6810df802f2827160ff894107fc6d21956bc321004f53

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:54

Target

2aca57577c0392fd390a5613719ba94d.exe
Size

423KB
MD5

2aca57577c0392fd390a5613719ba94d
SHA1

8e899df1bad9513c34bbf03df216d0d859ddb5a9
SHA256

f011f4318cda72c936d6810df802f2827160ff894107fc6d21956bc321004f53
SHA512

0a1d7517343a22362258dff7fdae26916cb6c7815088d71ae61ce3a80ed7b4bf0ab05c8aac2b6b3bbf25f52ff3ca140cfa3e55f476bdc36654f594b3f64a21b1
SSDEEP

6144:YWj0pS4koc6KN/BJc68RNYuohJ4R2Xtzojc8hEUaHpO4TMaSIoAf:nj0EPoALm3Ruuohqwca/BeAf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2072	2036	regsvr32.exe	17
PID 2036 wrote to memory of 2072	2036	regsvr32.exe	17
PID 2036 wrote to memory of 2072	2036	regsvr32.exe	17
PID 2036 wrote to memory of 2072	2036	regsvr32.exe	17
PID 2036 wrote to memory of 2072	2036	regsvr32.exe	17
PID 2036 wrote to memory of 2072	2036	regsvr32.exe	17
PID 2036 wrote to memory of 2072	2036	regsvr32.exe	17

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2aca57577c0392fd390a5613719ba94d.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2aca57577c0392fd390a5613719ba94d.exe
  2⤵
  PID:2072