ca23d3c5ed7a6271a9b2e973381eb42d3666c522b664f4040a1a4100bbef14f7

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 23:08

Target

4767ee32a54f754e27c8bc66ebd28fec.dll
Size

84KB
MD5

4767ee32a54f754e27c8bc66ebd28fec
SHA1

f993b5fde924c1a228924ef99256882d574238fa
SHA256

ca23d3c5ed7a6271a9b2e973381eb42d3666c522b664f4040a1a4100bbef14f7
SHA512

d8fd372dfe202c1297386a347d10f166161f4e6a4de32f1a424347747ff6c3150cdcd16b3059cbe342fb84362651f74fb5c0014ba2fe1f9e0b09e7a217f3298e
SSDEEP

1536:E0aazMHa2Znv8lypDsALzhYw7TE0PDsLEq0jWNAtApf4SpQE:waA7nv8lIsQzGw7TBbsLx2clppD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2208	2364	regsvr32.exe	28
PID 2364 wrote to memory of 2208	2364	regsvr32.exe	28
PID 2364 wrote to memory of 2208	2364	regsvr32.exe	28
PID 2364 wrote to memory of 2208	2364	regsvr32.exe	28
PID 2364 wrote to memory of 2208	2364	regsvr32.exe	28
PID 2364 wrote to memory of 2208	2364	regsvr32.exe	28
PID 2364 wrote to memory of 2208	2364	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4767ee32a54f754e27c8bc66ebd28fec.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4767ee32a54f754e27c8bc66ebd28fec.dll
  2⤵
  PID:2208