b3eb161ce5d471f388a221ece69ca1c67eeec17e0321a8c4a60d3c4382dbdac1

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-03-2024 02:41

Target

d7ae0fd94757731b354e095918d5bf9b.dll
Size

217KB
MD5

d7ae0fd94757731b354e095918d5bf9b
SHA1

71d78dca21ca45801a58b240ff76ab733ed4d929
SHA256

b3eb161ce5d471f388a221ece69ca1c67eeec17e0321a8c4a60d3c4382dbdac1
SHA512

c28359994ff7e27b4de0323da981694f0e34a617302d5b573ab2a2d25ebde7da45367ca9804a1b69a7b0d23eaa8f413ce6d1dba93b59c185a3a3aa02f9ee169d
SSDEEP

3072:0nrTYOnrTYOnrTYOnrTYOnrTYOnrTYOnrTY:0nrTTnrTTnrTTnrTTnrTTnrTTnrT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 3068	1728	regsvr32.exe	28
PID 1728 wrote to memory of 3068	1728	regsvr32.exe	28
PID 1728 wrote to memory of 3068	1728	regsvr32.exe	28
PID 1728 wrote to memory of 3068	1728	regsvr32.exe	28
PID 1728 wrote to memory of 3068	1728	regsvr32.exe	28
PID 1728 wrote to memory of 3068	1728	regsvr32.exe	28
PID 1728 wrote to memory of 3068	1728	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d7ae0fd94757731b354e095918d5bf9b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d7ae0fd94757731b354e095918d5bf9b.dll
  2⤵
  PID:3068

memory/3068-0-0x00000000001F0000-0x00000000001FD000-memory.dmp

Filesize
52KB

Download