3d01c646a463744bfa130cfe7beb4ced908579004886e9fa1263867dc37b9b2a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 08:18

Target

a163ed66e926a77a2d44e2be421f2e8b.dll
Size

100KB
MD5

a163ed66e926a77a2d44e2be421f2e8b
SHA1

9737bf92e2ef0796f4a6721ec78a718641e63217
SHA256

3d01c646a463744bfa130cfe7beb4ced908579004886e9fa1263867dc37b9b2a
SHA512

98b9f0411dc6afdfcd202c440b3270dbe6241325bb5f80bc4c610a08c818aa1b09882ae11795037b9c7ddd09319f062b746153e37a498a3d02640a8929ced036
SSDEEP

1536:33X3Re2j//ZWzB8q7iEDrvI8U3xAgomogCzzaIhTOr5cUVXhW2BH6Y676wlTVnY:33XhDgz97iWrv4LMyWSr5cUDt6Y676YY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2028	2072	regsvr32.exe	28
PID 2072 wrote to memory of 2028	2072	regsvr32.exe	28
PID 2072 wrote to memory of 2028	2072	regsvr32.exe	28
PID 2072 wrote to memory of 2028	2072	regsvr32.exe	28
PID 2072 wrote to memory of 2028	2072	regsvr32.exe	28
PID 2072 wrote to memory of 2028	2072	regsvr32.exe	28
PID 2072 wrote to memory of 2028	2072	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a163ed66e926a77a2d44e2be421f2e8b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a163ed66e926a77a2d44e2be421f2e8b.dll
  2⤵
  PID:2028

memory/2028-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download