a4c6eeed1631fa8fda0eb3abebdc8cacc678a145788dab5debfb4d66092f85c4

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 17:04

Target

ac664e07bec7caa3c3a85d98903131b3.dll
Size

33KB
MD5

ac664e07bec7caa3c3a85d98903131b3
SHA1

f637905e8416abebe6ea1de113d332280087eaaa
SHA256

a4c6eeed1631fa8fda0eb3abebdc8cacc678a145788dab5debfb4d66092f85c4
SHA512

42fc457195857e08dae361c29521c6cdc8a944a13380c66abb7f430fb082a620e470863fd1b606727e465218786d9d9e46da072adf69f01b89dbeaaf41c1fdc7
SSDEEP

768:9ehypCHCOii3RSjyoBxhJrhUomTzVVPRfns7Rp6vTWwH71Lyg:9/kHzii3RSjyyxDrhUfXxqcvf71Lyg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1728	2032	regsvr32.exe	28
PID 2032 wrote to memory of 1728	2032	regsvr32.exe	28
PID 2032 wrote to memory of 1728	2032	regsvr32.exe	28
PID 2032 wrote to memory of 1728	2032	regsvr32.exe	28
PID 2032 wrote to memory of 1728	2032	regsvr32.exe	28
PID 2032 wrote to memory of 1728	2032	regsvr32.exe	28
PID 2032 wrote to memory of 1728	2032	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ac664e07bec7caa3c3a85d98903131b3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ac664e07bec7caa3c3a85d98903131b3.dll
  2⤵
  PID:1728

memory/1728-0-0x0000000000100000-0x000000000010D000-memory.dmp

Filesize
52KB

Download