068d65dfda54a07ae2ee7973ac3e49ffe1d5367e741b29a8cd9b86dacb133be1

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 22:53

Target

c1d0482b4e9036608ed5b1b74a77cbc2.dll
Size

72KB
MD5

c1d0482b4e9036608ed5b1b74a77cbc2
SHA1

ff1a44650fb20f0ce5871c797f9255f255dd76c9
SHA256

068d65dfda54a07ae2ee7973ac3e49ffe1d5367e741b29a8cd9b86dacb133be1
SHA512

9658dcfb3b49483d8dee87e35fbefe95d3f9e88e0b063b2a4dc3635ae9b15f071e45149c889cef3021617b3ed5c934c105d715e4350f5be670a2e1d87ae2eb35
SSDEEP

768:1rLl/zNqNWw0DAo1wdpkavNb6ahoICS4AIeqc06iRnbI/uNmwY1jdsEgLa1auRe9:PNjD1wEyAICS4A4c0DBgj2LaJc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2072	3020	regsvr32.exe	28
PID 3020 wrote to memory of 2072	3020	regsvr32.exe	28
PID 3020 wrote to memory of 2072	3020	regsvr32.exe	28
PID 3020 wrote to memory of 2072	3020	regsvr32.exe	28
PID 3020 wrote to memory of 2072	3020	regsvr32.exe	28
PID 3020 wrote to memory of 2072	3020	regsvr32.exe	28
PID 3020 wrote to memory of 2072	3020	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c1d0482b4e9036608ed5b1b74a77cbc2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c1d0482b4e9036608ed5b1b74a77cbc2.dll
  2⤵
  PID:2072