e01416654a077036eb0cc53c329c6ad64173e78ef85efa9166212397ff9f0090

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 11:50

Target

971637360c181a779e3dc7112672a0e6.dll
Size

31KB
MD5

971637360c181a779e3dc7112672a0e6
SHA1

3e8fe64ed0dee15dda92373e6399f395d5e8f9aa
SHA256

e01416654a077036eb0cc53c329c6ad64173e78ef85efa9166212397ff9f0090
SHA512

7641ffdd7725c37751bc1550164d9a6cfe5b4fd89d289b2f75111bb127c679f3e56067d1d8461aea181cb2c028a934f1c7ce7ed05cbc8f2a745faab886d4d71c
SSDEEP

384:PCNe0cVyphzLpCgnqv68c8bIYb3mtnSvHTxCvV48lWH/p1iDbuEGJ8Q8Spvk:4ehyp6gqRViJSoJl2BknuEGJEJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2148	2356	regsvr32.exe	28
PID 2356 wrote to memory of 2148	2356	regsvr32.exe	28
PID 2356 wrote to memory of 2148	2356	regsvr32.exe	28
PID 2356 wrote to memory of 2148	2356	regsvr32.exe	28
PID 2356 wrote to memory of 2148	2356	regsvr32.exe	28
PID 2356 wrote to memory of 2148	2356	regsvr32.exe	28
PID 2356 wrote to memory of 2148	2356	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\971637360c181a779e3dc7112672a0e6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\971637360c181a779e3dc7112672a0e6.dll
  2⤵
  PID:2148

memory/2148-0-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download