8c090e773187609f36e6dae86c2b454150883fd20799e1675abc81bfb421b6d1

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 19:19

Target

8ff1f54eb33aa292da4ba5178875556b.dll
Size

276KB
MD5

8ff1f54eb33aa292da4ba5178875556b
SHA1

85cf8725dfd6acf371ad5266e96bdfc2558c4ded
SHA256

8c090e773187609f36e6dae86c2b454150883fd20799e1675abc81bfb421b6d1
SHA512

dc3b486bdc945c539c52936ab0877c324badd5d19049f4efac6e960dd5850489407844a41f62b638e8fde01a828f91a614ee9c4c97831138c41061d0f50402bd
SSDEEP

6144:dxgtU8eiUfsYxgtU8eiUfsYxgtU8eiUfsYxgtU8eiUfsYxgtU8eiUfsYxgtU8ein:dxgtTeDxgtTeDxgtTeDxgtTeDxgtTeDr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 3068	2864	regsvr32.exe	28
PID 2864 wrote to memory of 3068	2864	regsvr32.exe	28
PID 2864 wrote to memory of 3068	2864	regsvr32.exe	28
PID 2864 wrote to memory of 3068	2864	regsvr32.exe	28
PID 2864 wrote to memory of 3068	2864	regsvr32.exe	28
PID 2864 wrote to memory of 3068	2864	regsvr32.exe	28
PID 2864 wrote to memory of 3068	2864	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8ff1f54eb33aa292da4ba5178875556b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8ff1f54eb33aa292da4ba5178875556b.dll
  2⤵
  PID:3068

memory/3068-0-0x0000000000170000-0x0000000000181000-memory.dmp

Filesize
68KB

Download