be92ef6e4d6db34dd6396d800f38f4e0eea46a8748fa8564ee40d975c9798fb7

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 19:59

Target

a29fbbc6594b104c0f161b0cedd5e2f0.dll
Size

24KB
MD5

a29fbbc6594b104c0f161b0cedd5e2f0
SHA1

01de62d2430b0748ea7cc522ef5c508c5337c47b
SHA256

be92ef6e4d6db34dd6396d800f38f4e0eea46a8748fa8564ee40d975c9798fb7
SHA512

5487d3517bf6c40b84fed3f333da35d0699861e8a4b6ccc7e61bf2d8768cc4105b8ccec6d77c658f3b325be8bd6c16f6c23bf4863d994eac28ba87caab7ed33c
SSDEEP

384:uGKudT12WdMCpsjgTO5NdixBSlchSsT8pxs7Trjff5WVwcFsrd4/Fgb4:uzu71Mea5NdixBSOT6xarj0L/Fg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2976	2972	regsvr32.exe	28
PID 2972 wrote to memory of 2976	2972	regsvr32.exe	28
PID 2972 wrote to memory of 2976	2972	regsvr32.exe	28
PID 2972 wrote to memory of 2976	2972	regsvr32.exe	28
PID 2972 wrote to memory of 2976	2972	regsvr32.exe	28
PID 2972 wrote to memory of 2976	2972	regsvr32.exe	28
PID 2972 wrote to memory of 2976	2972	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a29fbbc6594b104c0f161b0cedd5e2f0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a29fbbc6594b104c0f161b0cedd5e2f0.dll
  2⤵
  PID:2976