a70d348b4729cf13f43cdaead5fd3099a0256345199f600ea17234322e986417

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 10:37

Target

b47ea0c323660bcdf677c382774293d8.dll
Size

86KB
MD5

b47ea0c323660bcdf677c382774293d8
SHA1

2e064be02bf803bc5e03461640cbe28c652d6765
SHA256

a70d348b4729cf13f43cdaead5fd3099a0256345199f600ea17234322e986417
SHA512

37a2175ff1fc5e5ecc2fb43ae94570a2cc6829915a00495a661de23556640b5defca836274e57c66c7e7e0f796593dc47e35c9d53a89ca6ec148f03c0adb18a8
SSDEEP

1536:hKsdoHt1bs1xkzc4Z+8jHtB216+cjLPB8lzNQSb0wG:hKsdoHt1byxWrjHj2kt35AQSa

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 356	2100	regsvr32.exe	28
PID 2100 wrote to memory of 356	2100	regsvr32.exe	28
PID 2100 wrote to memory of 356	2100	regsvr32.exe	28
PID 2100 wrote to memory of 356	2100	regsvr32.exe	28
PID 2100 wrote to memory of 356	2100	regsvr32.exe	28
PID 2100 wrote to memory of 356	2100	regsvr32.exe	28
PID 2100 wrote to memory of 356	2100	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b47ea0c323660bcdf677c382774293d8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b47ea0c323660bcdf677c382774293d8.dll
  2⤵
  PID:356

memory/356-0-0x0000000000500000-0x0000000000543000-memory.dmp

Filesize
268KB

Download