544ea09f179341144cf3f611c63ebf5cd3b53b8b18cb7cb9e4d5baef2b6ccd70

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:52

Target

750447566ce9abe554e882134c8f5a71.dll
Size

91KB
MD5

750447566ce9abe554e882134c8f5a71
SHA1

651a9fc21af3aae3c560f30b32b3e77806ee89c2
SHA256

544ea09f179341144cf3f611c63ebf5cd3b53b8b18cb7cb9e4d5baef2b6ccd70
SHA512

1d3030f44afa13ee617baa728d89461854566a1517a41e5f9ee155cf6f9dab7b9e7da264dd651943455be7c734abea44b7b38539d1826195f65d8ac66f6ea167
SSDEEP

768:qeP9h1smPdDsDdkWEw5fwxxJoeP9h1smPdDsDdkWEw5fwxxJoeP9h1smPdDsDdkh:qkfLWIXokfLWIXokfLWIX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3000 wrote to memory of 3048	3000	regsvr32.exe	regsvr32.exe
PID 3000 wrote to memory of 3048	3000	regsvr32.exe	regsvr32.exe
PID 3000 wrote to memory of 3048	3000	regsvr32.exe	regsvr32.exe
PID 3000 wrote to memory of 3048	3000	regsvr32.exe	regsvr32.exe
PID 3000 wrote to memory of 3048	3000	regsvr32.exe	regsvr32.exe
PID 3000 wrote to memory of 3048	3000	regsvr32.exe	regsvr32.exe
PID 3000 wrote to memory of 3048	3000	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\750447566ce9abe554e882134c8f5a71.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3000

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\750447566ce9abe554e882134c8f5a71.dll
2⤵
PID:3048

memory/3048-0-0x0000000000140000-0x000000000014D000-memory.dmp

Filesize
52KB

Download