281d1862d4a53e6f2928df0b13392bc516ee322f4d607472454f79adcd51aed6

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:58

Target

3700d4115c5f92ffd4a50de6f6b0ee5e.dll
Size

89KB
MD5

3700d4115c5f92ffd4a50de6f6b0ee5e
SHA1

e3d0b1e1925de7b8b66d6d51a3b49fde53b109cb
SHA256

281d1862d4a53e6f2928df0b13392bc516ee322f4d607472454f79adcd51aed6
SHA512

6fdce97cae91c0a3b6e30a4edb99a3b9f9df173fccf0ecc6c0f05f18c26cdd8523063ef4f929cc75d88b186540ee209dd26fa8f3e955468c5bf8190256711a82
SSDEEP

1536:Q1W8TrJdNV66+JrJfVd5d0kaQuG4qbBnihEDTRS/XGpFWX5H4T90g6xNkDi7ZaQY:Q1WoXNV66+1ZpddTuDqIsNEWepxNrTu9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2536	2520	regsvr32.exe	28
PID 2520 wrote to memory of 2536	2520	regsvr32.exe	28
PID 2520 wrote to memory of 2536	2520	regsvr32.exe	28
PID 2520 wrote to memory of 2536	2520	regsvr32.exe	28
PID 2520 wrote to memory of 2536	2520	regsvr32.exe	28
PID 2520 wrote to memory of 2536	2520	regsvr32.exe	28
PID 2520 wrote to memory of 2536	2520	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3700d4115c5f92ffd4a50de6f6b0ee5e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3700d4115c5f92ffd4a50de6f6b0ee5e.dll
  2⤵
  PID:2536

memory/2536-0-0x0000000000270000-0x00000000002B3000-memory.dmp

Filesize
268KB

Download