df16756794f0979f7dd561bdce38ad0980bd79f278b4bc0d77bb800e066301c3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 21:30

Target

c6e7306bed2cebd3634e6ebf5598ea3e.dll
Size

225KB
MD5

c6e7306bed2cebd3634e6ebf5598ea3e
SHA1

631743ab52bc0a035c289ca97b12b79ecdad041a
SHA256

df16756794f0979f7dd561bdce38ad0980bd79f278b4bc0d77bb800e066301c3
SHA512

74e014cf01e7fc055559973cc7a90a48aaf57b51f13a361783c7304dfa43d91abb2bdd1352e07b341a9fc8fc0f5450b831e4922d4338e3441bdc17b6369f037b
SSDEEP

6144:VSL2WVkdsSvlKJayaihm06xDCW7e0/Yit6tN3Gm6auzb1Hc2ESo1wm6YM:qmNlocZygt6tNWcSo1wm6YM

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2360	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2360	2388	regsvr32.exe	28
PID 2388 wrote to memory of 2360	2388	regsvr32.exe	28
PID 2388 wrote to memory of 2360	2388	regsvr32.exe	28
PID 2388 wrote to memory of 2360	2388	regsvr32.exe	28
PID 2388 wrote to memory of 2360	2388	regsvr32.exe	28
PID 2388 wrote to memory of 2360	2388	regsvr32.exe	28
PID 2388 wrote to memory of 2360	2388	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c6e7306bed2cebd3634e6ebf5598ea3e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c6e7306bed2cebd3634e6ebf5598ea3e.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2360

memory/2360-0-0x0000000010000000-0x000000001003C000-memory.dmp

Filesize
240KB

Download