c4e16301a51dd44607db6a846b5e1d9ca3ae92d4fc9219afa3d1a50149b01653

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 07:46

Target

cd80b12d4877cb26a25d2af6dcf14c0c.dll
Size

45KB
MD5

cd80b12d4877cb26a25d2af6dcf14c0c
SHA1

c9f89e10a4749c006ccb9d4832091a18e4a59794
SHA256

c4e16301a51dd44607db6a846b5e1d9ca3ae92d4fc9219afa3d1a50149b01653
SHA512

6dd0a169e9042f581038a55ba96fc86dac69afc4f7b6aed0b76d9db25a548ff798b497815f08ea24cd914893b5d20d6bee1f2ef40fa255303ce1df2097b6be7e
SSDEEP

768:h881R5oxNRHZs+LehC6v7iHCjMA2XVrb7imnJnU4fU5x4qBCH:hzC5s+LehCuiHCj/2l5FfUflCH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2488	1692	regsvr32.exe	28
PID 1692 wrote to memory of 2488	1692	regsvr32.exe	28
PID 1692 wrote to memory of 2488	1692	regsvr32.exe	28
PID 1692 wrote to memory of 2488	1692	regsvr32.exe	28
PID 1692 wrote to memory of 2488	1692	regsvr32.exe	28
PID 1692 wrote to memory of 2488	1692	regsvr32.exe	28
PID 1692 wrote to memory of 2488	1692	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cd80b12d4877cb26a25d2af6dcf14c0c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cd80b12d4877cb26a25d2af6dcf14c0c.dll
  2⤵
  PID:2488