9608ebdf41680a441dbe2b73f5fcc1a65b77b229cd4407826a3fbe5f2618339a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 03:41

Target

8e1ff11edbc1e85fa21e80137e033c4d.dll
Size

167KB
MD5

8e1ff11edbc1e85fa21e80137e033c4d
SHA1

d4e574c6c70729cedfddd8181cefb6079734851f
SHA256

9608ebdf41680a441dbe2b73f5fcc1a65b77b229cd4407826a3fbe5f2618339a
SHA512

611814335be5bc7950753ebb24c38dc8cee6093da420c7ab51cddce6461c3512142197d914c8bd90b26fc0e4ece1da3dcf26c02d470682261a2244606f7c019e
SSDEEP

1536:8MdNbv9M8I+Q6ejYmZ4KvZVBwHXVAxhG4F6ZCueYJ6ijA5Yj4byFszXESig2:tb106ePKKvZwXiaCueK4YjuyYXEz1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2384	2128	regsvr32.exe	17
PID 2128 wrote to memory of 2384	2128	regsvr32.exe	17
PID 2128 wrote to memory of 2384	2128	regsvr32.exe	17
PID 2128 wrote to memory of 2384	2128	regsvr32.exe	17
PID 2128 wrote to memory of 2384	2128	regsvr32.exe	17
PID 2128 wrote to memory of 2384	2128	regsvr32.exe	17
PID 2128 wrote to memory of 2384	2128	regsvr32.exe	17

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\8e1ff11edbc1e85fa21e80137e033c4d.dll
1⤵
PID:2384

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8e1ff11edbc1e85fa21e80137e033c4d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2128