25c7048372bd1c70499320e7d6b2eb5c308bf59567ca8a5bb64f2c5e11069cc8

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 11:03

Target

c876e0fb0983e772250934d0b9c4ba51.dll
Size

30KB
MD5

c876e0fb0983e772250934d0b9c4ba51
SHA1

ee9f73cdea5540e6348a37904a551e2cc0a1316b
SHA256

25c7048372bd1c70499320e7d6b2eb5c308bf59567ca8a5bb64f2c5e11069cc8
SHA512

4dbbfd2683edcec3215288f6876bb1dc5b7d96980d356f5dc823d69a3eb1d51e43d9a1d6eeb5840dce4ad8c7f14b402f78a6ef44e69d1e22f0060bb75137bb96
SSDEEP

384:FCNe0cVyphNFfRMkQAuER7cx3hYPMyM2JcMGCSuZ658WIH8wfCoqX:qehyp7P158hYPWSvGC1bWw8wKoS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2352	1872	regsvr32.exe	28
PID 1872 wrote to memory of 2352	1872	regsvr32.exe	28
PID 1872 wrote to memory of 2352	1872	regsvr32.exe	28
PID 1872 wrote to memory of 2352	1872	regsvr32.exe	28
PID 1872 wrote to memory of 2352	1872	regsvr32.exe	28
PID 1872 wrote to memory of 2352	1872	regsvr32.exe	28
PID 1872 wrote to memory of 2352	1872	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c876e0fb0983e772250934d0b9c4ba51.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c876e0fb0983e772250934d0b9c4ba51.dll
  2⤵
  PID:2352

memory/2352-0-0x00000000000C0000-0x00000000000CD000-memory.dmp

Filesize
52KB

Download