1573bc6d04b1d6e736bd2d2a94d39f4a8f6261639d2877979026abcb6dd4cf36

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 00:34

Target

75eb8ab1c10a4d70bb9a1a8f7a7355d8.dll
Size

85KB
MD5

75eb8ab1c10a4d70bb9a1a8f7a7355d8
SHA1

7e322fbe056004f4fd539ddae4c50afc231864b6
SHA256

1573bc6d04b1d6e736bd2d2a94d39f4a8f6261639d2877979026abcb6dd4cf36
SHA512

9329c804cf851305990d88e82e23ee0615fba181082e60482dc729d601683387d0fd423db0673acab714c527930550936631456c71744163741fa1dcb03f5a99
SSDEEP

1536:MIE10udXy7nzU+iL0HFr2tTX+SjkhyXjJjrQzDvZ6axYmrdV4l2ichY:M3OTiYH5CX+SjksavZ6wYmrr4llYY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2684	3012	regsvr32.exe	28
PID 3012 wrote to memory of 2684	3012	regsvr32.exe	28
PID 3012 wrote to memory of 2684	3012	regsvr32.exe	28
PID 3012 wrote to memory of 2684	3012	regsvr32.exe	28
PID 3012 wrote to memory of 2684	3012	regsvr32.exe	28
PID 3012 wrote to memory of 2684	3012	regsvr32.exe	28
PID 3012 wrote to memory of 2684	3012	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\75eb8ab1c10a4d70bb9a1a8f7a7355d8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\75eb8ab1c10a4d70bb9a1a8f7a7355d8.dll
  2⤵
  PID:2684

memory/2684-0-0x00000000004C0000-0x00000000004FE000-memory.dmp

Filesize
248KB

Download
memory/2684-1-0x00000000004C0000-0x00000000004FE000-memory.dmp

Filesize
248KB

Download