e61b0af971c29c59f677e434afaaf29edb2e4573ae05a52a83abd20d562940ca

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 15:50

Target

7d6066917c81ff22a89901298a4cdf3d.dll
Size

356KB
MD5

7d6066917c81ff22a89901298a4cdf3d
SHA1

e69e384679fd51da634097f596ec393da0b49e18
SHA256

e61b0af971c29c59f677e434afaaf29edb2e4573ae05a52a83abd20d562940ca
SHA512

9cb207f853acce2736338378042563fc325dcf8b25184602a8716e78b9a2735ab51c42a749badedfbcd9253f322272c54ebd1e6ba270d9d689ab1564a58d5c6e
SSDEEP

6144:4iG4vu8ZPXk1YOWkHwzU9qUTCmyQQEsC+SWQeOOSxp6piG4vu8ZPXkbA9R9:y4lxTOWiUU9q1hbV4lxpP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2356	1700	regsvr32.exe	28
PID 1700 wrote to memory of 2356	1700	regsvr32.exe	28
PID 1700 wrote to memory of 2356	1700	regsvr32.exe	28
PID 1700 wrote to memory of 2356	1700	regsvr32.exe	28
PID 1700 wrote to memory of 2356	1700	regsvr32.exe	28
PID 1700 wrote to memory of 2356	1700	regsvr32.exe	28
PID 1700 wrote to memory of 2356	1700	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7d6066917c81ff22a89901298a4cdf3d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7d6066917c81ff22a89901298a4cdf3d.dll
  2⤵
  PID:2356