95d7192252d6932223c010d6b994ad8873d4b1e7a8e6ff17840780088829df17

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 19:32

Target

95d7192252d6932223c010d6b994ad8873d4b1e7a8e6ff17840780088829df17.dll
Size

404KB
MD5

995e60604d352ac35d345e919808803a
SHA1

ed0f4b8313f4e53ef6263d08426dd1736b297ecb
SHA256

95d7192252d6932223c010d6b994ad8873d4b1e7a8e6ff17840780088829df17
SHA512

fc3fe8875b7487c9d32f7a7cbab5ad571bffc898939204c75e7842462f0acba439555b2f7410c87d0c11f78efafb79013798de791d4a351ab28cab6cd2e7b5ef
SSDEEP

6144:8dnKaTnjDKxbJizduRi94Y6Fe35DRt51Bbtf2w+yIFo2vmOfPz/LvV/cmqVTgdW:8dNnSxtizQA94fyDRtpbtMrNqKg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1888 wrote to memory of 2304	1888	regsvr32.exe	regsvr32.exe
PID 1888 wrote to memory of 2304	1888	regsvr32.exe	regsvr32.exe
PID 1888 wrote to memory of 2304	1888	regsvr32.exe	regsvr32.exe
PID 1888 wrote to memory of 2304	1888	regsvr32.exe	regsvr32.exe
PID 1888 wrote to memory of 2304	1888	regsvr32.exe	regsvr32.exe
PID 1888 wrote to memory of 2304	1888	regsvr32.exe	regsvr32.exe
PID 1888 wrote to memory of 2304	1888	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\95d7192252d6932223c010d6b994ad8873d4b1e7a8e6ff17840780088829df17.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\95d7192252d6932223c010d6b994ad8873d4b1e7a8e6ff17840780088829df17.dll
2⤵
PID:2304