fd339bc296af59ce75148e0d4f75256d7679d5894041dc0e4d1b821309dd4737

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 08:45

Target

fd339bc296af59ce75148e0d4f75256d7679d5894041dc0e4d1b821309dd4737.dll
Size

715KB
MD5

d3a49e0ccef799d6d10237037e10510b
SHA1

c09f817d2f295335c621e6cd820ecca6ead587b3
SHA256

fd339bc296af59ce75148e0d4f75256d7679d5894041dc0e4d1b821309dd4737
SHA512

618f6e0a54ae867971355fe516fd9af3863de2aef80b1bb30ee7e80855ed7edb5d4526a0264324c513127da23aa9adda7bb81bc577321785962601b17aedbd61
SSDEEP

12288:9wdofEyUhL0EGNW3oJdThiqhVcd/LT0rQraCWH:9wdo8yUhLVGNFjmL2d

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1932	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1932	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1932	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1932	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1932	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1932	2200	regsvr32.exe	28
PID 2200 wrote to memory of 1932	2200	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fd339bc296af59ce75148e0d4f75256d7679d5894041dc0e4d1b821309dd4737.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fd339bc296af59ce75148e0d4f75256d7679d5894041dc0e4d1b821309dd4737.dll
  2⤵
  PID:1932