5c19bfa5799c758bfc69626be720c50bcdfa36d2f55fb90d9ac5b7914f2a79cd

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 09:12

Target

531c3bcb5b0effb7a016de94f8de020d.exe
Size

314KB
MD5

531c3bcb5b0effb7a016de94f8de020d
SHA1

4c8b0f4667dd5caf20f3c4c7cfebe5ec308827d7
SHA256

5c19bfa5799c758bfc69626be720c50bcdfa36d2f55fb90d9ac5b7914f2a79cd
SHA512

f6a2b0970a44fea1a2f9ab6c8d883eb70f122ea01e1943daa49efe3c9c83c2bbe4ba8d9b543c0c228e887437e228051184ca6ad6a92c255467dca3929438a72b
SSDEEP

6144:sTlK8mqpvqBW+GuFLmBNqjpxm8ht5rYWqtDB6OQI9W5j3CL0O5:sFmiCBGuFa3Ox1LrYPRFO5O5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2524	2896	regsvr32.exe	16
PID 2896 wrote to memory of 2524	2896	regsvr32.exe	16
PID 2896 wrote to memory of 2524	2896	regsvr32.exe	16
PID 2896 wrote to memory of 2524	2896	regsvr32.exe	16
PID 2896 wrote to memory of 2524	2896	regsvr32.exe	16
PID 2896 wrote to memory of 2524	2896	regsvr32.exe	16
PID 2896 wrote to memory of 2524	2896	regsvr32.exe	16

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\531c3bcb5b0effb7a016de94f8de020d.exe
1⤵
PID:2524

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\531c3bcb5b0effb7a016de94f8de020d.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2896