4bd3d4ac27cc73e959fc9f73f8d52b96364328f02fc4a37997dd5a3796010b05

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 15:33

Target

4bd3d4ac27cc73e959fc9f73f8d52b96364328f02fc4a37997dd5a3796010b05.dll
Size

6.5MB
MD5

78156319c202ea9e4716f3abb7fd3b9c
SHA1

3ed1be89e56ee42053c7f1b92a13c34007cf6b2f
SHA256

4bd3d4ac27cc73e959fc9f73f8d52b96364328f02fc4a37997dd5a3796010b05
SHA512

7ba72113618993a8ee6fe843cb9f084214f83f74037322be5e6f934b76eb0b160a7722583540571ad7535aa70d6c5de8f8ce996ed63d47f10423fd8b89ee0d4d
SSDEEP

196608:8TlPCEQ9dP6Yb/NM/WbrmVW1aPhBepbz+:uG6Yb/NM/WbrmVsaPveF+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2104	624	regsvr32.exe	28
PID 624 wrote to memory of 2104	624	regsvr32.exe	28
PID 624 wrote to memory of 2104	624	regsvr32.exe	28
PID 624 wrote to memory of 2104	624	regsvr32.exe	28
PID 624 wrote to memory of 2104	624	regsvr32.exe	28
PID 624 wrote to memory of 2104	624	regsvr32.exe	28
PID 624 wrote to memory of 2104	624	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4bd3d4ac27cc73e959fc9f73f8d52b96364328f02fc4a37997dd5a3796010b05.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4bd3d4ac27cc73e959fc9f73f8d52b96364328f02fc4a37997dd5a3796010b05.dll
  2⤵
  PID:2104