5886142b6cc786a00930bcc95dc4904ca77bfa1035e77bcaa29bd8708f429781

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 16:05

Target

53f76c076f281cf59c4648979f04e285.dll
Size

77KB
MD5

53f76c076f281cf59c4648979f04e285
SHA1

878063777c0bee6c44eac7274828d35ad9ace790
SHA256

5886142b6cc786a00930bcc95dc4904ca77bfa1035e77bcaa29bd8708f429781
SHA512

d7a913119d52853f002a6aea9ba25694a97fd16262e90209b7af0b2a7d8c1d655c3061529b22703c7db22df0aa4e9b0d070f249be8b649295e42da2f2d4c2321
SSDEEP

1536:RgSNyhyhIXgloTwtVRc76H4iCGNTjuUkk/lb2Rm8WLK7:RYhoIViqJTijuU3db2RxOu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2516	2504	regsvr32.exe	28
PID 2504 wrote to memory of 2516	2504	regsvr32.exe	28
PID 2504 wrote to memory of 2516	2504	regsvr32.exe	28
PID 2504 wrote to memory of 2516	2504	regsvr32.exe	28
PID 2504 wrote to memory of 2516	2504	regsvr32.exe	28
PID 2504 wrote to memory of 2516	2504	regsvr32.exe	28
PID 2504 wrote to memory of 2516	2504	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\53f76c076f281cf59c4648979f04e285.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\53f76c076f281cf59c4648979f04e285.dll
  2⤵
  PID:2516

memory/2516-0-0x0000000000210000-0x000000000024D000-memory.dmp

Filesize
244KB

Download