a17b4a83e36a02f22d64cff10a32ddfa4756ad44334fa72079f6a11342b71e1b

Analysis

max time kernel
13s
max time network
16s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12-04-2024 01:38

Target

Maryann 2023 Tax Organizer/g2m.dll
Size

150.0MB
MD5

3ceefa7bd30b2b5494c2cdb64342835c
SHA1

ef4cad7600788cc696cec53480dcfb67a5143adb
SHA256

e8eb6be89b47c2c5f4b61da460ae6c6d6bf150869624ad487df74b0d80351233
SHA512

a3f88fae400037427d3068d583317c08132ff936c21c3fa38a97afedb9b614302228903973ed3aa8b41fb266f5e1aa3c7550ce4b4653ea9d4b1c06a0c350880f
SSDEEP

786432:7UP7GCGO7b0Srkx/tC0SzIdSwh/WxbpNHQD3trzRp:7UP7GCG64Srkx1hSzYsHQD3t/R

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2244 wrote to memory of 2776	2244	regsvr32.exe	regsvr32.exe
PID 2244 wrote to memory of 2776	2244	regsvr32.exe	regsvr32.exe
PID 2244 wrote to memory of 2776	2244	regsvr32.exe	regsvr32.exe
PID 2244 wrote to memory of 2776	2244	regsvr32.exe	regsvr32.exe
PID 2244 wrote to memory of 2776	2244	regsvr32.exe	regsvr32.exe
PID 2244 wrote to memory of 2776	2244	regsvr32.exe	regsvr32.exe
PID 2244 wrote to memory of 2776	2244	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Maryann 2023 Tax Organizer\g2m.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\SysWOW64\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\Maryann 2023 Tax Organizer\g2m.dll"
2⤵
PID:2776

memory/2776-0-0x0000000010000000-0x0000000012DB3000-memory.dmp

Filesize
45.7MB

Download
memory/2776-1-0x0000000010000000-0x0000000012DB3000-memory.dmp

Filesize
45.7MB

Download