c9fd9bfc68709dc2b5da117824ad4300069ac19bb6af5319905b34dfd73c3a8e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 23:42

Target

b5f48479abf531d730fac9ca96f99f3d.dll
Size

42KB
MD5

b5f48479abf531d730fac9ca96f99f3d
SHA1

f5eb03ac1c06f678b3b6f7435a4144c936e0aa1b
SHA256

c9fd9bfc68709dc2b5da117824ad4300069ac19bb6af5319905b34dfd73c3a8e
SHA512

f9d40a147beba95e021fa3ae62414664729ee3028efe652f254cd723db87396c7bd99125aa7ad9c4a9e4690d26a556d762cb7b3e74734d1d2a9652e08850175c
SSDEEP

768:QfFSZqm5cYoEy98KqfaPZHVHwNEi2n0TyTs7eCFH+Lpaovl0S2WnW:EFSA0cayW6VHwb2n0YwXViaoi6n

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2120	1996	regsvr32.exe	28
PID 1996 wrote to memory of 2120	1996	regsvr32.exe	28
PID 1996 wrote to memory of 2120	1996	regsvr32.exe	28
PID 1996 wrote to memory of 2120	1996	regsvr32.exe	28
PID 1996 wrote to memory of 2120	1996	regsvr32.exe	28
PID 1996 wrote to memory of 2120	1996	regsvr32.exe	28
PID 1996 wrote to memory of 2120	1996	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b5f48479abf531d730fac9ca96f99f3d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b5f48479abf531d730fac9ca96f99f3d.dll
  2⤵
  PID:2120