e7f182893b01672e68c2c0568cab9078e2b6422005a5e83d4faa830882588a8d

Analysis

max time kernel
143s
max time network
146s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
02-04-2024 09:51

Target

44e12bae1e5d309752e35b420897ebaf229a041ce9ad35c5b47dd224a2499071.dll
Size

347KB
MD5

c5f25f45c07cb4e0291eea6e8a8779fb
SHA1

2e17aaee110bf573587193f0e374eecd8b75c228
SHA256

44e12bae1e5d309752e35b420897ebaf229a041ce9ad35c5b47dd224a2499071
SHA512

3b5a101ad0c7853e04918e3831aac9ddaadcb539ad9e2aaeca87a80e011e2d57443cc3158117f9cf6179960cf54a5475174e7c2a29fa8925c22b3a0ab24011cd
SSDEEP

6144:BX1K0hROWQHfYtH4ve6REwSBPuuOVN7Oc5jthTq5wzDigK:F1KMEWQHfaYveI6OT7x/1Dig

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2832 regsvr32.exe
2212 regsvr32.exe
2212 regsvr32.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regsvr32.exe

pid process

2832 regsvr32.exe

pid	process
2832	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2832 wrote to memory of 2212	2832	regsvr32.exe	regsvr32.exe
PID 2832 wrote to memory of 2212	2832	regsvr32.exe	regsvr32.exe
PID 2832 wrote to memory of 2212	2832	regsvr32.exe	regsvr32.exe
PID 2832 wrote to memory of 2212	2832	regsvr32.exe	regsvr32.exe
PID 2832 wrote to memory of 2212	2832	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WYUpCd\iwjJcjvbiQ.dll"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2212