1ddc4e3f1ef20d827e0a40d06e3779efb701a9861fe05911fda91dcd44723f57

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 21:34

Target

51adb6de7607bf5bf645f438720601bd.exe
Size

366KB
MD5

51adb6de7607bf5bf645f438720601bd
SHA1

08dd77ac76cf82a259eda4ba3afe9e2daab4c425
SHA256

1ddc4e3f1ef20d827e0a40d06e3779efb701a9861fe05911fda91dcd44723f57
SHA512

08e6fbf06ac8ad9ed055ce23b0f23ea865792b6fd01f45b99f735237e10c04e1f2070abc13bd065785f1a52ec747c1d75bd06ef346b843afd353906e016c4c4d
SSDEEP

6144:tnSB/2fETEiSuIdxS0eVk19belMraHptngdc7msxxt4LN/pnTT:tSB/M6EpVdxS0eVk1dCrHpVgezt4T3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 1748	2884	regsvr32.exe	28
PID 2884 wrote to memory of 1748	2884	regsvr32.exe	28
PID 2884 wrote to memory of 1748	2884	regsvr32.exe	28
PID 2884 wrote to memory of 1748	2884	regsvr32.exe	28
PID 2884 wrote to memory of 1748	2884	regsvr32.exe	28
PID 2884 wrote to memory of 1748	2884	regsvr32.exe	28
PID 2884 wrote to memory of 1748	2884	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\51adb6de7607bf5bf645f438720601bd.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\51adb6de7607bf5bf645f438720601bd.exe
  2⤵
  PID:1748