ea24ff6dfdbf391b2885e56e484b251cd8aa940104eac90c7a4509218da9954b

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 17:02

Target

cbf31ed11be083b2bd889cf7a960a129.dll
Size

89KB
MD5

cbf31ed11be083b2bd889cf7a960a129
SHA1

a0c1a4e2afe6b31645eb024391d85e9478dfe94f
SHA256

ea24ff6dfdbf391b2885e56e484b251cd8aa940104eac90c7a4509218da9954b
SHA512

4ea117a422a10a76e2791fe7613aceb352259ccef5129e6d0d6ed3bd3836f862198fd6ce7ba48b491c8baad3485435bdc760ad8f11846f3474c3f12b7c1a3dc9
SSDEEP

1536:FC1QNaO4cEjfSdsGQw+DXzcxDTF7rgg4YPlsGfN2k0TnLg/MIxn:o1CRGfSdsTzwprggzPlsG8DLA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 2180	1372	regsvr32.exe	28
PID 1372 wrote to memory of 2180	1372	regsvr32.exe	28
PID 1372 wrote to memory of 2180	1372	regsvr32.exe	28
PID 1372 wrote to memory of 2180	1372	regsvr32.exe	28
PID 1372 wrote to memory of 2180	1372	regsvr32.exe	28
PID 1372 wrote to memory of 2180	1372	regsvr32.exe	28
PID 1372 wrote to memory of 2180	1372	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cbf31ed11be083b2bd889cf7a960a129.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cbf31ed11be083b2bd889cf7a960a129.dll
  2⤵
  PID:2180

memory/2180-0-0x0000000000360000-0x00000000003A4000-memory.dmp

Filesize
272KB

Download
memory/2180-1-0x0000000000360000-0x00000000003A4000-memory.dmp

Filesize
272KB

Download