c56c37bd40d82039b4f9b0fbf3a4c182504ce65f404732c010eca68245f27f78

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 21:09

Target

b8321be0656eb835fe44dda2ecd37163.dll
Size

80KB
MD5

b8321be0656eb835fe44dda2ecd37163
SHA1

521def101e3ed758066498a51f0d4ceb60024ab6
SHA256

c56c37bd40d82039b4f9b0fbf3a4c182504ce65f404732c010eca68245f27f78
SHA512

1f4eb49d45b2409362babff5cb12ca4c94f73c4d0d770ea2f6f6b59b0bf55678ce35b43704cd1df826bd882f928b89c96b9fd0feb008e69847d2f9e47dcc753a
SSDEEP

1536:t1zQtgy/Bjk9HV8Yz50QxzqIgqDO+FdO3FjiOCIBK3bvl4bG0DS3:t1Ik916QxzvOyCFjTCpj2Gj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2900	2872	regsvr32.exe	28
PID 2872 wrote to memory of 2900	2872	regsvr32.exe	28
PID 2872 wrote to memory of 2900	2872	regsvr32.exe	28
PID 2872 wrote to memory of 2900	2872	regsvr32.exe	28
PID 2872 wrote to memory of 2900	2872	regsvr32.exe	28
PID 2872 wrote to memory of 2900	2872	regsvr32.exe	28
PID 2872 wrote to memory of 2900	2872	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b8321be0656eb835fe44dda2ecd37163.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b8321be0656eb835fe44dda2ecd37163.dll
  2⤵
  PID:2900

memory/2900-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download