49e67da7587b30b034e52cada8ed73b0f38bfae6ae50bfc2c7a4cfba0e21ccad

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 22:35

Target

c70605ce8aa0620b77bb67b622a07d86.dll
Size

83KB
MD5

c70605ce8aa0620b77bb67b622a07d86
SHA1

02fb9a6b611694cc9fcb36a2b04582dd5a846fbc
SHA256

49e67da7587b30b034e52cada8ed73b0f38bfae6ae50bfc2c7a4cfba0e21ccad
SHA512

ffe8a0d43bc5f301b2e5e469e03c67e7af30bb422aab09f78b7e68a57b67658fa95d7d6c34f15fb49781c72c619f672b1582818e9f8e13b4ac5699486cbb9785
SSDEEP

1536:++FSgGE0yk4OWwvPJU6bCmt6RC9BMRMOUdRPF0h8k79Pl5E0HW6JxqRvr2HZVuwI:TSodQhU6HUC9kUdRPFidkjvAZAa1Cx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1188	1632	regsvr32.exe	28
PID 1632 wrote to memory of 1188	1632	regsvr32.exe	28
PID 1632 wrote to memory of 1188	1632	regsvr32.exe	28
PID 1632 wrote to memory of 1188	1632	regsvr32.exe	28
PID 1632 wrote to memory of 1188	1632	regsvr32.exe	28
PID 1632 wrote to memory of 1188	1632	regsvr32.exe	28
PID 1632 wrote to memory of 1188	1632	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c70605ce8aa0620b77bb67b622a07d86.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c70605ce8aa0620b77bb67b622a07d86.dll
  2⤵
  PID:1188

memory/1188-0-0x0000000000260000-0x000000000029E000-memory.dmp

Filesize
248KB

Download