271de5aed87a398dedf889c16d7927e90f07facb4774a073cd4f365073fe51f8

Resubmissions

29-02-2024 21:17

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-02-2024 21:17

Target

AppUtil.dll
Size

1.5MB
MD5

ea966aaea4634e68ddf601507bdbfbd8
SHA1

df2492ee0704ff4a49d1957bd9321c9e24b5b3e7
SHA256

2156f931969b571a01f067a61a902655af7eb0280f5476896b42a6f864ac9a07
SHA512

55c9c80b705a0621d2e7f4ca6e556581a542f69f9cb4fb6ae2997cb96b02ebc8b111a4030a967738682b46fb672adaeff2a3aa0f270a41e58c159fb49dd0f661
SSDEEP

24576:f8VkPNZLUJzoKeECO/He8wekOHklDRLulTScsVPvL2MK4SVtIH+1v9uJDL:fPUJqSUulTtsVPvaM9SVtIH+1v9uh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 356	1940	regsvr32.exe	28
PID 1940 wrote to memory of 356	1940	regsvr32.exe	28
PID 1940 wrote to memory of 356	1940	regsvr32.exe	28
PID 1940 wrote to memory of 356	1940	regsvr32.exe	28
PID 1940 wrote to memory of 356	1940	regsvr32.exe	28
PID 1940 wrote to memory of 356	1940	regsvr32.exe	28
PID 1940 wrote to memory of 356	1940	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AppUtil.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\AppUtil.dll
  2⤵
  PID:356