330294d664248f9cc459917a297ad570f193425b75e1f4687bdcc959772698b0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 05:14

Target

ba9ac609b53250b74000dc97ff12d443.dll
Size

84KB
MD5

ba9ac609b53250b74000dc97ff12d443
SHA1

bc54c9d066e156dd76b0f1f75cd2e2ac45be090f
SHA256

330294d664248f9cc459917a297ad570f193425b75e1f4687bdcc959772698b0
SHA512

eb9caa0387b4069ce72aceb73de11c96ac3661a8ec6efd977ae002c92ea25e0e8c6dd12addaa3a1e8671c5730d4342567be2b534efc649a1276eb1dca70d5534
SSDEEP

1536:TSA7rT6c0L4SPsvfcYxlz1Aix1e56lnQ/55h2/FahpXB87c7:TPaAfcYfz1nne8nQ/5D20XBGc7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3068	2924	regsvr32.exe	28
PID 2924 wrote to memory of 3068	2924	regsvr32.exe	28
PID 2924 wrote to memory of 3068	2924	regsvr32.exe	28
PID 2924 wrote to memory of 3068	2924	regsvr32.exe	28
PID 2924 wrote to memory of 3068	2924	regsvr32.exe	28
PID 2924 wrote to memory of 3068	2924	regsvr32.exe	28
PID 2924 wrote to memory of 3068	2924	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ba9ac609b53250b74000dc97ff12d443.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ba9ac609b53250b74000dc97ff12d443.dll
  2⤵
  PID:3068

memory/3068-0-0x0000000000210000-0x000000000024E000-memory.dmp

Filesize
248KB

Download