3d65f1685167c36b0c54069e0ae1208a86db1fb29f5124af032565717bac2dad

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 22:07

Target

87c7fb94af0b3ccd6a224242ef61d04d.dll
Size

89KB
MD5

87c7fb94af0b3ccd6a224242ef61d04d
SHA1

03f70d52c10a98cd9c8b6d85c04ad335eadf4a7d
SHA256

3d65f1685167c36b0c54069e0ae1208a86db1fb29f5124af032565717bac2dad
SHA512

05631d31c2e5a842ad28be5166ce7f7bda00c5da8dcce560a7dc08eb1bcd217342ad2d3f0b52dce297431b586ca9dbdff79c7ae1d84728e68718ee46647d15a6
SSDEEP

1536:qf5iwvF7Tpqmq3ZA9R7YboD3hS1Uh0956GtoYk1ppVdl7PybhOfyI+boU:U5RvF7Tkmq3ZqR7Y0D3eUh666oYk15ze

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2460	2432	regsvr32.exe	28
PID 2432 wrote to memory of 2460	2432	regsvr32.exe	28
PID 2432 wrote to memory of 2460	2432	regsvr32.exe	28
PID 2432 wrote to memory of 2460	2432	regsvr32.exe	28
PID 2432 wrote to memory of 2460	2432	regsvr32.exe	28
PID 2432 wrote to memory of 2460	2432	regsvr32.exe	28
PID 2432 wrote to memory of 2460	2432	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\87c7fb94af0b3ccd6a224242ef61d04d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\87c7fb94af0b3ccd6a224242ef61d04d.dll
  2⤵
  PID:2460

memory/2460-0-0x00000000001C0000-0x0000000000203000-memory.dmp

Filesize
268KB

Download