338c23abbf9f4d792d9bac20f519c89fafc6d340dbfd7afea56ebb5ea8f449b5

Analysis

max time kernel
46s
max time network
16s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 00:26

Target

e8eb6be89b47c2c5f4b61da460ae6c6d6bf150869624ad487df74b0d80351233.dll
Size

150.0MB
MD5

3ceefa7bd30b2b5494c2cdb64342835c
SHA1

ef4cad7600788cc696cec53480dcfb67a5143adb
SHA256

e8eb6be89b47c2c5f4b61da460ae6c6d6bf150869624ad487df74b0d80351233
SHA512

a3f88fae400037427d3068d583317c08132ff936c21c3fa38a97afedb9b614302228903973ed3aa8b41fb266f5e1aa3c7550ce4b4653ea9d4b1c06a0c350880f
SSDEEP

786432:7UP7GCGO7b0Srkx/tC0SzIdSwh/WxbpNHQD3trzRp:7UP7GCG64Srkx1hSzYsHQD3t/R

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2784 wrote to memory of 2160	2784	regsvr32.exe	regsvr32.exe
PID 2784 wrote to memory of 2160	2784	regsvr32.exe	regsvr32.exe
PID 2784 wrote to memory of 2160	2784	regsvr32.exe	regsvr32.exe
PID 2784 wrote to memory of 2160	2784	regsvr32.exe	regsvr32.exe
PID 2784 wrote to memory of 2160	2784	regsvr32.exe	regsvr32.exe
PID 2784 wrote to memory of 2160	2784	regsvr32.exe	regsvr32.exe
PID 2784 wrote to memory of 2160	2784	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e8eb6be89b47c2c5f4b61da460ae6c6d6bf150869624ad487df74b0d80351233.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\e8eb6be89b47c2c5f4b61da460ae6c6d6bf150869624ad487df74b0d80351233.dll
2⤵
PID:2160

memory/2160-1-0x0000000010000000-0x0000000012DB3000-memory.dmp

Filesize
45.7MB

Download
memory/2160-3-0x0000000010000000-0x0000000012DB3000-memory.dmp

Filesize
45.7MB

Download
memory/2160-2-0x0000000010000000-0x0000000012DB3000-memory.dmp

Filesize
45.7MB

Download