0433300d63b596e0c3124eee761470fa984b80f0247d29c3f322d03581ca99c7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 11:35

Target

cdf65f9ee46313602e658cea26d4b9db.dll
Size

82KB
MD5

cdf65f9ee46313602e658cea26d4b9db
SHA1

067a816a5b56920e2b929d014d5cc8204ec071a0
SHA256

0433300d63b596e0c3124eee761470fa984b80f0247d29c3f322d03581ca99c7
SHA512

ebe57acaa3725da9bf6ba16b7066b44c936ef70aa896f1a06a6b20fcd8e77bf217678626d78884400fadaaeb429ae01fb812fd8239075ed7b0e8dff6bfc725f3
SSDEEP

1536:fngwz66Zc91e10sp5EeVQ6ZbLPz8ikCNelkKAwH274Eq8yk:fnbP5EeVQqbLr8R9AwHYM8yk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	28
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	28
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	28
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	28
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	28
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	28
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cdf65f9ee46313602e658cea26d4b9db.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cdf65f9ee46313602e658cea26d4b9db.dll
  2⤵
  PID:2376

memory/2376-0-0x00000000001B0000-0x00000000001EE000-memory.dmp

Filesize
248KB

Download