e916f20f701402bec4dbc26954647d338eb5ef0d4dca96e8a43bb5dbc8ca1836

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 10:15

Target

8c133be53d017ddf92891453ea6b6e4f.dll
Size

60KB
MD5

8c133be53d017ddf92891453ea6b6e4f
SHA1

a9576631e9d93bd105c7e26d241450d7e260301c
SHA256

e916f20f701402bec4dbc26954647d338eb5ef0d4dca96e8a43bb5dbc8ca1836
SHA512

3af514453830413ea0f7e961f3bba589e0fd0b6daefddbeb527283c5b7c5a4051923fbd1834b61de1b56ffaa634a15245fb33d42f28b0fc13e301765299d101f
SSDEEP

768:MyDB+uAcV/REhbWkHY9p10+Bl05p/BuPMDde1g3nN/aBj14T22nyQ3W+lOZ5:vD8cV/64kHY9puV5p/WMnqyTBlOT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1276	1700	regsvr32.exe	28
PID 1700 wrote to memory of 1276	1700	regsvr32.exe	28
PID 1700 wrote to memory of 1276	1700	regsvr32.exe	28
PID 1700 wrote to memory of 1276	1700	regsvr32.exe	28
PID 1700 wrote to memory of 1276	1700	regsvr32.exe	28
PID 1700 wrote to memory of 1276	1700	regsvr32.exe	28
PID 1700 wrote to memory of 1276	1700	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8c133be53d017ddf92891453ea6b6e4f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8c133be53d017ddf92891453ea6b6e4f.dll
  2⤵
  PID:1276