ca8a15727d665b4302e4282ae81949c53c535d77f48b65e2a53e9c88f85e7e36

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 01:52

Target

8b1533cd472ff71a4a76b8bbfaf56645.dll
Size

100KB
MD5

8b1533cd472ff71a4a76b8bbfaf56645
SHA1

1a70d311eed712b75f85131719e79eb4118ea527
SHA256

ca8a15727d665b4302e4282ae81949c53c535d77f48b65e2a53e9c88f85e7e36
SHA512

e406aab4d0dc7e1ba256b523e2f711977d73a8046f2ee74dcf4dd4fafa0d8baa7083cff25bc33c52e88c486706a3e5af8ba443efd4261a4a6a0fc1e7c8089ec5
SSDEEP

1536:DYh/cWtl/chUtp/00/IwDgX2N+3BqVUg25Zy879ND8vcuNMXKassC44fIJP:DsZl/Ftx00QwE2+Gh2O879mORbC47JP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1556	2008	regsvr32.exe	28
PID 2008 wrote to memory of 1556	2008	regsvr32.exe	28
PID 2008 wrote to memory of 1556	2008	regsvr32.exe	28
PID 2008 wrote to memory of 1556	2008	regsvr32.exe	28
PID 2008 wrote to memory of 1556	2008	regsvr32.exe	28
PID 2008 wrote to memory of 1556	2008	regsvr32.exe	28
PID 2008 wrote to memory of 1556	2008	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8b1533cd472ff71a4a76b8bbfaf56645.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8b1533cd472ff71a4a76b8bbfaf56645.dll
  2⤵
  PID:1556

memory/1556-0-0x00000000001D0000-0x0000000000217000-memory.dmp

Filesize
284KB

Download