5f647c54df220611f86bfae71fda809bc970f5be83c39a015c140ca1889acc0d

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 11:22

Target

cb46cd39fafd0f05e51b78649b498a08.dll
Size

170KB
MD5

cb46cd39fafd0f05e51b78649b498a08
SHA1

f3033c23d4c954bf0b8de8eabb66f7f420f44fd9
SHA256

5f647c54df220611f86bfae71fda809bc970f5be83c39a015c140ca1889acc0d
SHA512

3412a5a6fe8ff0be6b867901a39ee047ca66bc98683f343a4981edbc13d6172acb285279a9af340629967637f0d0dc609f0b21b23ce8f1b8ab66a0e6dbbd828b
SSDEEP

3072:eUXlFI6Kqyss2qQwPyEKM3yCFWPusDBdR8ZdCzH/SxwsK1kN22B3szwk1:eMXI6HyNqSx3yC8PVDBdRaCzH/Sxwn1D

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1736	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1736	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1736	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1736	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1736	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1736	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1736	2020	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cb46cd39fafd0f05e51b78649b498a08.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cb46cd39fafd0f05e51b78649b498a08.dll
  2⤵
  PID:1736