c53f0052e0552efcba123df07102ca7817bb7d2739507902501af2b25856ba13

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 18:10

Target

878b9e0e8058d1b2d5a02ec00220fe64.dll
Size

43KB
MD5

878b9e0e8058d1b2d5a02ec00220fe64
SHA1

08456572b60ea34869cebca9da0e6b0905e34341
SHA256

c53f0052e0552efcba123df07102ca7817bb7d2739507902501af2b25856ba13
SHA512

8c08858cfcc666a9b990755d3f08fb5adc1eb6948383c50fbadeb270e94ccca251c2c23de42a3c53b0a2542abbc7cfaa0890168d57d5b8425c7366fa475147b4
SSDEEP

768:H88F+8S1Rh3eBh3m7uOpADuPO1QlbKoFebb7PU+vSEFKrdEba31W:HjS3U3m7uIIuPlWoUb7PUQSE0hbW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3044	3032	regsvr32.exe	28
PID 3032 wrote to memory of 3044	3032	regsvr32.exe	28
PID 3032 wrote to memory of 3044	3032	regsvr32.exe	28
PID 3032 wrote to memory of 3044	3032	regsvr32.exe	28
PID 3032 wrote to memory of 3044	3032	regsvr32.exe	28
PID 3032 wrote to memory of 3044	3032	regsvr32.exe	28
PID 3032 wrote to memory of 3044	3032	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\878b9e0e8058d1b2d5a02ec00220fe64.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\878b9e0e8058d1b2d5a02ec00220fe64.dll
  2⤵
  PID:3044

memory/3044-0-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download