5a98e027413c17a092d04b5336448316b0933e5cfd0dac15c3dc2097d854f807

Analysis

max time kernel
49s
max time network
19s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-04-2024 02:16

Target

g2m.dll
Size

15.1MB
MD5

53cd4b218deb3fd9b31ae4f54daf0e0b
SHA1

1fdbcd6296487943b57c073a5a0aac36fead5f1e
SHA256

6edc001310ea4896cc410b9d5dd8beaf912f8a71f1be60c139780d0bf5507007
SHA512

771fa9878109ee683733ac930fc828b3448d31b41ca50202952a44bfc0c8a32b75343b814d1f5d054a3272d0b9c11e245c562c9a3799fffb2ae677c3ea4c04aa
SSDEEP

196608:/m0ivGTAslgbSYBsnBho/wnBvq+4rMOblxz6qYFS1qY2aubxi58/EUxFFVsIE:/mzvfaEog+4rdbUTFVjE

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2656 wrote to memory of 2676	2656	regsvr32.exe	regsvr32.exe
PID 2656 wrote to memory of 2676	2656	regsvr32.exe	regsvr32.exe
PID 2656 wrote to memory of 2676	2656	regsvr32.exe	regsvr32.exe
PID 2656 wrote to memory of 2676	2656	regsvr32.exe	regsvr32.exe
PID 2656 wrote to memory of 2676	2656	regsvr32.exe	regsvr32.exe
PID 2656 wrote to memory of 2676	2656	regsvr32.exe	regsvr32.exe
PID 2656 wrote to memory of 2676	2656	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\g2m.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\g2m.dll
2⤵
PID:2676

memory/2676-1-0x0000000010000000-0x0000000010F8F000-memory.dmp

Filesize
15.6MB

Download
memory/2676-2-0x0000000010000000-0x0000000010F8F000-memory.dmp

Filesize
15.6MB

Download
memory/2676-3-0x0000000010000000-0x0000000010F8F000-memory.dmp

Filesize
15.6MB

Download
memory/2676-5-0x0000000010000000-0x0000000010F8F000-memory.dmp

Filesize
15.6MB

Download
memory/2676-6-0x00000000001F0000-0x00000000001FA000-memory.dmp

Filesize
40KB

Download
memory/2676-7-0x00000000001F0000-0x00000000001FA000-memory.dmp

Filesize
40KB

Download