b61a944ae61900b6541a8dda90471a58ed482dadd7e03a3dde536c4f7c8b9cda

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 11:02

Target

bb1a08021adce61d8b87a38b2e112519.dll
Size

85KB
MD5

bb1a08021adce61d8b87a38b2e112519
SHA1

62962d699625c3f2b30f1f5f736a522118c4e301
SHA256

b61a944ae61900b6541a8dda90471a58ed482dadd7e03a3dde536c4f7c8b9cda
SHA512

7c178dac4bc7e783b747f9e73dd646ca7aee984fb9ab85f404c46fe01e067320c3e143b61b3ee2cb68072bb8ad87c8a84a33ad7a9ac63a8943c5672d1dc4ffde
SSDEEP

1536:6DSf9qLRiLN0tXi0ftLRwxma5XMKET9ioq58BqFT+5YHbm379graofJxmV:6K9eiLNQvwwaGwFT+5f2+6JwV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2228	1660	regsvr32.exe	28
PID 1660 wrote to memory of 2228	1660	regsvr32.exe	28
PID 1660 wrote to memory of 2228	1660	regsvr32.exe	28
PID 1660 wrote to memory of 2228	1660	regsvr32.exe	28
PID 1660 wrote to memory of 2228	1660	regsvr32.exe	28
PID 1660 wrote to memory of 2228	1660	regsvr32.exe	28
PID 1660 wrote to memory of 2228	1660	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bb1a08021adce61d8b87a38b2e112519.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bb1a08021adce61d8b87a38b2e112519.dll
  2⤵
  PID:2228

memory/2228-0-0x00000000001D0000-0x000000000020F000-memory.dmp

Filesize
252KB

Download