1e255962fe3aaaec53b128e0f90df4e501daf2d772699b65885520e2279b05f1

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 01:39

Target

3b91491f249ea99799b7a18763198741.dll
Size

82KB
MD5

3b91491f249ea99799b7a18763198741
SHA1

b6d955836942f79aae6f42ebd9d24b4a3fcd35b3
SHA256

1e255962fe3aaaec53b128e0f90df4e501daf2d772699b65885520e2279b05f1
SHA512

30217d770907befed6657fff1dbf67891daaee32b025ecb1fd60943ed8f11831d17f548bdfd0beceae2eb35916b02958995ce48293dfda3f289b52ff20df412e
SSDEEP

1536:w+TxFAOVTZQO0vCT73YSE4qUFixPLw0qSEAB99o3ejmiD7x/EXgbrv6mUrKF2w+b:BA+ZQOzFiv5BE3WXDtqGAw+b

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2984	3016	regsvr32.exe	28
PID 3016 wrote to memory of 2984	3016	regsvr32.exe	28
PID 3016 wrote to memory of 2984	3016	regsvr32.exe	28
PID 3016 wrote to memory of 2984	3016	regsvr32.exe	28
PID 3016 wrote to memory of 2984	3016	regsvr32.exe	28
PID 3016 wrote to memory of 2984	3016	regsvr32.exe	28
PID 3016 wrote to memory of 2984	3016	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3b91491f249ea99799b7a18763198741.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3b91491f249ea99799b7a18763198741.dll
  2⤵
  PID:2984

memory/2984-0-0x00000000001C0000-0x00000000001FE000-memory.dmp

Filesize
248KB

Download