2f53d7cac5006981b445cf6a41f5549600469b4ab45473835159c7856362890c

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 15:17

Target

53ddb61cf02a398c78f21b450c2e2c96.dll
Size

86KB
MD5

53ddb61cf02a398c78f21b450c2e2c96
SHA1

dfd75ca5ea09770c5e6e38d8fd475a6928a2d2e7
SHA256

2f53d7cac5006981b445cf6a41f5549600469b4ab45473835159c7856362890c
SHA512

e4d0de31c9032294178e352b190733e8b9667436e2a18285fa64912e817bad4093b91fa78a1f2c96bdabdd46e603180e83cdc5ec023b22a6794aecfa64f137dc
SSDEEP

1536:+Rb102l4vhIPlQUWRzPH16ppBBZYi60xURGMDCON3YfqU3GSXXW+NJdcfgtzii1a:yb102lJPlQrRzPc1ZYidxUxDBFYhztkt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1612	2060	regsvr32.exe	27
PID 2060 wrote to memory of 1612	2060	regsvr32.exe	27
PID 2060 wrote to memory of 1612	2060	regsvr32.exe	27
PID 2060 wrote to memory of 1612	2060	regsvr32.exe	27
PID 2060 wrote to memory of 1612	2060	regsvr32.exe	27
PID 2060 wrote to memory of 1612	2060	regsvr32.exe	27
PID 2060 wrote to memory of 1612	2060	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\53ddb61cf02a398c78f21b450c2e2c96.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\53ddb61cf02a398c78f21b450c2e2c96.dll
  2⤵
  PID:1612

memory/1612-0-0x00000000001F0000-0x0000000000233000-memory.dmp

Filesize
268KB

Download
memory/1612-1-0x00000000001F0000-0x0000000000233000-memory.dmp

Filesize
268KB

Download