cf3f59d191602570a4710d4bc1baf4c9c2a104c8318acb60d422a60c4d100f01

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 18:21

Target

7dae8e4ecad9b20434c2277618f8640c.dll
Size

50KB
MD5

7dae8e4ecad9b20434c2277618f8640c
SHA1

059141ebad09c8ddb421dc6deb8684d0c5b42106
SHA256

cf3f59d191602570a4710d4bc1baf4c9c2a104c8318acb60d422a60c4d100f01
SHA512

81d97d10368a6148d4013b45ed8280576d95051168b0da35e879fede9581e578d1441e293144290d761e1d19634d9234dcf8471f50e4505b6be1b419ae13d9b4
SSDEEP

768:3CTFunAU5yp3Z3qfkAJnAdFQtf86iKBHzuE6/deeOT9e4K0KAY:3TAUIlc9JAUt/iaiE6LOT9eP0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2132	2128	regsvr32.exe	28
PID 2128 wrote to memory of 2132	2128	regsvr32.exe	28
PID 2128 wrote to memory of 2132	2128	regsvr32.exe	28
PID 2128 wrote to memory of 2132	2128	regsvr32.exe	28
PID 2128 wrote to memory of 2132	2128	regsvr32.exe	28
PID 2128 wrote to memory of 2132	2128	regsvr32.exe	28
PID 2128 wrote to memory of 2132	2128	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7dae8e4ecad9b20434c2277618f8640c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7dae8e4ecad9b20434c2277618f8640c.dll
  2⤵
  PID:2132