06fa5fd514aada1cce40353d14340ecdbf78b7cd58b04c2263f4debbec2b73d4

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 01:00

Target

59dce33c20d640cb234662684a29b409.dll
Size

78KB
MD5

59dce33c20d640cb234662684a29b409
SHA1

f92251f26fdd5bcd9085bb78a9d735f9c07c3765
SHA256

06fa5fd514aada1cce40353d14340ecdbf78b7cd58b04c2263f4debbec2b73d4
SHA512

d595889aa0b1ba2baea85dec5daf778cbcfdb55b83ea781520da16c9d0faaa315c621aab6f48c1a443e58c83536ed62e4ec0a6d209f135369884c88c3d4c0d36
SSDEEP

1536:WXoK1JVAI45uc3MR0qAcxNQnmAIZ0tuTzsMwfxNi2/TW6ShfMnq5:vK7n4scnncxZZ0tqzNmNCNhfAM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 2000	1572	regsvr32.exe	28
PID 1572 wrote to memory of 2000	1572	regsvr32.exe	28
PID 1572 wrote to memory of 2000	1572	regsvr32.exe	28
PID 1572 wrote to memory of 2000	1572	regsvr32.exe	28
PID 1572 wrote to memory of 2000	1572	regsvr32.exe	28
PID 1572 wrote to memory of 2000	1572	regsvr32.exe	28
PID 1572 wrote to memory of 2000	1572	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\59dce33c20d640cb234662684a29b409.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\59dce33c20d640cb234662684a29b409.dll
  2⤵
  PID:2000

memory/2000-0-0x00000000001B0000-0x00000000001EF000-memory.dmp

Filesize
252KB

Download