7b17d3989c4396bc6b983ea3f58ee952840f45a8a2f47870b4410973d732906e

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 12:27

Target

8f26604bb2b631b466f8c74e1842d81a.dll
Size

87KB
MD5

8f26604bb2b631b466f8c74e1842d81a
SHA1

3f3b2240e723c70c79a0fa82525459ab4bcca26b
SHA256

7b17d3989c4396bc6b983ea3f58ee952840f45a8a2f47870b4410973d732906e
SHA512

b7b547a26e7751098f839af62a5e40d03e2c1f752cc72e04d64ce98ca9cedd40d68ce26d7c90d8c7f9df609ba71ae287b6844451d4f71a8620ebbe8876831ecf
SSDEEP

1536:cP7Id1u5g0FJX6q6RmKzoXdH72S5ctn3tAA0zJM54H5MySjQhyuTL88KFuqopJGN:cPM+g0FJKq6RbzoNHv58d0VM546ySj9p

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2180	2512	regsvr32.exe	28
PID 2512 wrote to memory of 2180	2512	regsvr32.exe	28
PID 2512 wrote to memory of 2180	2512	regsvr32.exe	28
PID 2512 wrote to memory of 2180	2512	regsvr32.exe	28
PID 2512 wrote to memory of 2180	2512	regsvr32.exe	28
PID 2512 wrote to memory of 2180	2512	regsvr32.exe	28
PID 2512 wrote to memory of 2180	2512	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8f26604bb2b631b466f8c74e1842d81a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8f26604bb2b631b466f8c74e1842d81a.dll
  2⤵
  PID:2180

memory/2180-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download