b7317adf6411ccc297bedb0b8cecf28b39670592e1a5707f055e69f5e7e7694e

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 06:03

Target

ab2dc29e5425bfa5395745be1d35f607.dll
Size

79KB
MD5

ab2dc29e5425bfa5395745be1d35f607
SHA1

876f439dfcc86a5efba96cee7b18d6e9b0e9c547
SHA256

b7317adf6411ccc297bedb0b8cecf28b39670592e1a5707f055e69f5e7e7694e
SHA512

c48f14ccc64ee279b83a39d7290a746a007dd284f6b24b61c46c0d0b79e7af38bcf115039fb2d1409ccf4e10b0471397f233c319d2eb0c5a6a17c8be5fe11b50
SSDEEP

1536:jpaNabCuYt4M5AAMCdNAL4bC4hTLWWc1k5S8urONgYQ70oE+Av:Ejug4MWdCT6yLWWcrDM4705+U

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1648	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1648	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1648	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1648	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1648	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1648	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1648	1684	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ab2dc29e5425bfa5395745be1d35f607.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ab2dc29e5425bfa5395745be1d35f607.dll
  2⤵
  PID:1648

memory/1648-0-0x0000000000180000-0x00000000001BF000-memory.dmp

Filesize
252KB

Download