30da83a02fe87d691d6f456fab30e10c47b31c32c312caee7880b2c7a9c6fdc6

Analysis

max time kernel
120s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:19

Target

39940e0bd75a7a153566412d7aa7a848.dll
Size

89KB
MD5

39940e0bd75a7a153566412d7aa7a848
SHA1

81efc14343bc0f931ea091743bb38c664aae9a4a
SHA256

30da83a02fe87d691d6f456fab30e10c47b31c32c312caee7880b2c7a9c6fdc6
SHA512

269c0072f597479d780163cbdcd929af9f0e97bfb20ba196d0e795dff135ad5ff466f1afaa920cde7f838d176aef0c2062aff4daf888b5c9278d4b2e8105767e
SSDEEP

1536:5LCrAU5CAsrAF1ROgIj6ng8/3g67sLR1fBkXsjwgHGN8Eu782xsHaUjqF1u:5LWArrAF1RlIjmPGLf2cjwzpMUHaUWFk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2420	3068	regsvr32.exe	20
PID 3068 wrote to memory of 2420	3068	regsvr32.exe	20
PID 3068 wrote to memory of 2420	3068	regsvr32.exe	20
PID 3068 wrote to memory of 2420	3068	regsvr32.exe	20
PID 3068 wrote to memory of 2420	3068	regsvr32.exe	20
PID 3068 wrote to memory of 2420	3068	regsvr32.exe	20
PID 3068 wrote to memory of 2420	3068	regsvr32.exe	20

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\39940e0bd75a7a153566412d7aa7a848.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\39940e0bd75a7a153566412d7aa7a848.dll
  2⤵
  PID:2420

memory/2420-0-0x0000000000160000-0x00000000001A3000-memory.dmp

Filesize
268KB

Download