566fb57ced31f6457986f260cd74797a4a4f07b86263326490f0588cb2b3576d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:22

Target

39ab17b943c73cc91b88475f3c6607a3.dll
Size

213KB
MD5

39ab17b943c73cc91b88475f3c6607a3
SHA1

d8447022dd66badd9239510d5fd75a700e3fc51d
SHA256

566fb57ced31f6457986f260cd74797a4a4f07b86263326490f0588cb2b3576d
SHA512

543b3fb6037a51a0f3858c2d58e566b6819802ae11c667850a30e088ae86633f4805c760f6a0380dccba6387a5c8d8383e0a8dd49d8c1df9556f264353ea539c
SSDEEP

3072:txICUuxICUuxICUuxICUuxICUuxICUuxICU:TICUGICUGICUGICUGICUGICUGICU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1912	3020	regsvr32.exe	28
PID 3020 wrote to memory of 1912	3020	regsvr32.exe	28
PID 3020 wrote to memory of 1912	3020	regsvr32.exe	28
PID 3020 wrote to memory of 1912	3020	regsvr32.exe	28
PID 3020 wrote to memory of 1912	3020	regsvr32.exe	28
PID 3020 wrote to memory of 1912	3020	regsvr32.exe	28
PID 3020 wrote to memory of 1912	3020	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\39ab17b943c73cc91b88475f3c6607a3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\39ab17b943c73cc91b88475f3c6607a3.dll
  2⤵
  PID:1912

memory/1912-0-0x0000000000180000-0x000000000018D000-memory.dmp

Filesize
52KB

Download