49e6d400af1293ea416f81d26f66854c2982795aeae0dbe23f98b4579b90a4f5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 03:23

Target

5559c3ee4499ab044c96dd3ce525528b.dll
Size

103KB
MD5

5559c3ee4499ab044c96dd3ce525528b
SHA1

1151de8a408548537b2e0a69b95404856cd9dc31
SHA256

49e6d400af1293ea416f81d26f66854c2982795aeae0dbe23f98b4579b90a4f5
SHA512

2d0d6402c9c07af63b4c6a345aa7807354ad473d8aea5a68168e8da291abb08d41553a1a141fac1da2d195de87b83b5807bff473a24907b140f7a73e0072e358
SSDEEP

768:dCQoi6qZOMQOppibaZXYTq45AOUdQwk2lxeZO0neunVv+JNgxZ9+6cczruNiO4/k:dCQv6qZpQc7sqClolx10v+KZ9mcbIYC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2220	2180	regsvr32.exe	28
PID 2180 wrote to memory of 2220	2180	regsvr32.exe	28
PID 2180 wrote to memory of 2220	2180	regsvr32.exe	28
PID 2180 wrote to memory of 2220	2180	regsvr32.exe	28
PID 2180 wrote to memory of 2220	2180	regsvr32.exe	28
PID 2180 wrote to memory of 2220	2180	regsvr32.exe	28
PID 2180 wrote to memory of 2220	2180	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5559c3ee4499ab044c96dd3ce525528b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5559c3ee4499ab044c96dd3ce525528b.dll
  2⤵
  PID:2220

memory/2220-0-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download