5ba385af35d672c75fb4b612536f32b3005be1c8198d076d38d6077e2bd34051

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 03:11

Target

5260773787b48a22f961b46dade0c49d.dll
Size

30KB
MD5

5260773787b48a22f961b46dade0c49d
SHA1

abacdf8908acbb1b75a6a6a89f62621909bfd5a1
SHA256

5ba385af35d672c75fb4b612536f32b3005be1c8198d076d38d6077e2bd34051
SHA512

e4292966a9604df4f896a6c982664321b90556b1c6dd5b57b6a2debfc8585d3c09426271e59ff49426ae776cf243bbc30c09640ee57497bbedf4e9694d9ed0a3
SSDEEP

384:eNNe06t9hc+hmISiz/BGrAxllNEa9TsXaMFBAwzeY5HIGZCN8WIHedz:6eP9hDZfTNEa9TYaqATAZnWwM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2316	2876	regsvr32.exe	27
PID 2876 wrote to memory of 2316	2876	regsvr32.exe	27
PID 2876 wrote to memory of 2316	2876	regsvr32.exe	27
PID 2876 wrote to memory of 2316	2876	regsvr32.exe	27
PID 2876 wrote to memory of 2316	2876	regsvr32.exe	27
PID 2876 wrote to memory of 2316	2876	regsvr32.exe	27
PID 2876 wrote to memory of 2316	2876	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5260773787b48a22f961b46dade0c49d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5260773787b48a22f961b46dade0c49d.dll
  2⤵
  PID:2316

memory/2316-0-0x0000000000180000-0x000000000018D000-memory.dmp

Filesize
52KB

Download