d00ba4f2ba74ac880be6e2090ffc662abf1803b5fb9c30617f78576813840a40

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 07:59

Target

58671a8857e69413cf6474473dfa0c12.dll
Size

116KB
MD5

58671a8857e69413cf6474473dfa0c12
SHA1

ee7ea8e50f38e0337b92c1b763e50fd093c18329
SHA256

d00ba4f2ba74ac880be6e2090ffc662abf1803b5fb9c30617f78576813840a40
SHA512

9d78cedb1dc86c55df339a4457baed949767942f207eddc051fa5c2c68d8084081381f8b85156954677d8bd6af6082c9a5383d682a756ff1f85d157252faff45
SSDEEP

768:ioi5qZO+QeSPozbizFNpy8Oqvj+kQxSBFq0gMrs/fM3AwITl0FhH5bwVZtrDh:iv5qZnQCzbYKgK0ns83yTl0vH5baZz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2032	1364	regsvr32.exe	18
PID 1364 wrote to memory of 2032	1364	regsvr32.exe	18
PID 1364 wrote to memory of 2032	1364	regsvr32.exe	18
PID 1364 wrote to memory of 2032	1364	regsvr32.exe	18
PID 1364 wrote to memory of 2032	1364	regsvr32.exe	18
PID 1364 wrote to memory of 2032	1364	regsvr32.exe	18
PID 1364 wrote to memory of 2032	1364	regsvr32.exe	18

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\58671a8857e69413cf6474473dfa0c12.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\58671a8857e69413cf6474473dfa0c12.dll
  2⤵
  PID:2032

memory/2032-0-0x00000000001D0000-0x00000000001ED000-memory.dmp

Filesize
116KB

Download
memory/2032-1-0x00000000001D0000-0x00000000001ED000-memory.dmp

Filesize
116KB

Download