7d428010c5cd53c74a10667beb3588417ddbbf44e3d956c777078ba17599105b

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 17:22

Target

c6733a727781a495c416cd5a6c4bfae2.dll
Size

82KB
MD5

c6733a727781a495c416cd5a6c4bfae2
SHA1

379a2c041d68d6459e29788064918925af7dd72e
SHA256

7d428010c5cd53c74a10667beb3588417ddbbf44e3d956c777078ba17599105b
SHA512

dbddec33bf8114c26e349f37beecf9eec7eb14bfe5b0a4036c7cddd6f6adc1b773f26b9884b8eed9ba8a7f753d33fbc18c4177dd16b00e2b420b8d734ffbd8d1
SSDEEP

1536:KM6PGkmFJxwVuEIZdWbEFyaD/fcUCQ8/I8sxmkcIUbh0Q0rsVv0IN8bEFa:v6PGkmFJxyuEIZsOVcU18S1dUFBoA08e

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2948	1488	regsvr32.exe	28
PID 1488 wrote to memory of 2948	1488	regsvr32.exe	28
PID 1488 wrote to memory of 2948	1488	regsvr32.exe	28
PID 1488 wrote to memory of 2948	1488	regsvr32.exe	28
PID 1488 wrote to memory of 2948	1488	regsvr32.exe	28
PID 1488 wrote to memory of 2948	1488	regsvr32.exe	28
PID 1488 wrote to memory of 2948	1488	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c6733a727781a495c416cd5a6c4bfae2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c6733a727781a495c416cd5a6c4bfae2.dll
  2⤵
  PID:2948

memory/2948-0-0x0000000000140000-0x0000000000181000-memory.dmp

Filesize
260KB

Download