7868645e53316c128bbbbb3dd40d5df60c17f420d5f6952fbb6e2a8ca91ac750

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 01:30

Target

bf7ccddbb0393182457802c21196a5c2.dll
Size

206KB
MD5

bf7ccddbb0393182457802c21196a5c2
SHA1

819dc776235e23a463e1ede67266f72e2b979247
SHA256

7868645e53316c128bbbbb3dd40d5df60c17f420d5f6952fbb6e2a8ca91ac750
SHA512

241309bd63970789a13c96dda93712ec73921a905c89ec565b097cdc7eaf5452fa4c5bbb86bcf0efc3c9943b341ea22f5aa6295f8719c12fff39287db52cf22a
SSDEEP

1536:lkfDZezhDf1rkfDZezhDf1rkfDZezhDf1rkfDZezhDf1rkfDZezhDf1rkfDZezhN:uiNQiNQiNQiNQiNQiNQiN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 1636	2876	regsvr32.exe	28
PID 2876 wrote to memory of 1636	2876	regsvr32.exe	28
PID 2876 wrote to memory of 1636	2876	regsvr32.exe	28
PID 2876 wrote to memory of 1636	2876	regsvr32.exe	28
PID 2876 wrote to memory of 1636	2876	regsvr32.exe	28
PID 2876 wrote to memory of 1636	2876	regsvr32.exe	28
PID 2876 wrote to memory of 1636	2876	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bf7ccddbb0393182457802c21196a5c2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bf7ccddbb0393182457802c21196a5c2.dll
  2⤵
  PID:1636

memory/1636-0-0x00000000001C0000-0x00000000001CD000-memory.dmp

Filesize
52KB

Download