90c37a9ed351e9bdfba03d26557f726c5247b1ba74163d90e0cfd7677257d855

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 23:01

Target

d74b5bd8857f6cfc4bd9c6edcb30e079.dll
Size

610KB
MD5

d74b5bd8857f6cfc4bd9c6edcb30e079
SHA1

ba4c950997072e6edc206e57931e2b9761fed2b8
SHA256

90c37a9ed351e9bdfba03d26557f726c5247b1ba74163d90e0cfd7677257d855
SHA512

40397109bef5596ea2bd0d37e2c8d94de9509bd1ca614c7a616a87d0ed3db587b608040f60a25446771307437073ebeacf6c6ce22e3a154244b3be859a849df6
SSDEEP

12288:pyA1ZdqVfv/6HftOIA3+00wstpSdCi3TLdrvikAKsFVBw8HeIBv7pj:51fqZCHwIr00taCiHR69FTeIBT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2216	2168	regsvr32.exe	28
PID 2168 wrote to memory of 2216	2168	regsvr32.exe	28
PID 2168 wrote to memory of 2216	2168	regsvr32.exe	28
PID 2168 wrote to memory of 2216	2168	regsvr32.exe	28
PID 2168 wrote to memory of 2216	2168	regsvr32.exe	28
PID 2168 wrote to memory of 2216	2168	regsvr32.exe	28
PID 2168 wrote to memory of 2216	2168	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d74b5bd8857f6cfc4bd9c6edcb30e079.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d74b5bd8857f6cfc4bd9c6edcb30e079.dll
  2⤵
  PID:2216