3f77641a01107b6c1ed3098eb3565546ce46f996907dfabd6d946a1c611f9ba8

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 17:21

Target

8ce772a1c30297595708b5f44ff618c2.dll
Size

140KB
MD5

8ce772a1c30297595708b5f44ff618c2
SHA1

5ad2e28af9505f24a4395469f0dad66e1aa48ef3
SHA256

3f77641a01107b6c1ed3098eb3565546ce46f996907dfabd6d946a1c611f9ba8
SHA512

0531120ea1b53371f5a03eba399fedbb487b877b69b351e066b619e19ddf6f9bfba64ad29436c6d290d46c51c22636bae3ae16c8b63d1b085bb5f080359b00e6
SSDEEP

1536:kR8hbwrP95HG+7lHGZ9LjTGCXdRPF0h8k79Pl5E0HW6HKkDYJEbDwrO4E:GzvyZc+RPFidkGuEbDwy

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 3052	1216	regsvr32.exe	28
PID 1216 wrote to memory of 3052	1216	regsvr32.exe	28
PID 1216 wrote to memory of 3052	1216	regsvr32.exe	28
PID 1216 wrote to memory of 3052	1216	regsvr32.exe	28
PID 1216 wrote to memory of 3052	1216	regsvr32.exe	28
PID 1216 wrote to memory of 3052	1216	regsvr32.exe	28
PID 1216 wrote to memory of 3052	1216	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8ce772a1c30297595708b5f44ff618c2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8ce772a1c30297595708b5f44ff618c2.dll
  2⤵
  PID:3052

memory/3052-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download