5dbe59453affdbdc633604298c2cfe56d2b6000e12b497db0ca7f9a857e1c948

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 22:03

Target

5dbe59453affdbdc633604298c2cfe56d2b6000e12b497db0ca7f9a857e1c948.dll
Size

61KB
MD5

934143cdd3a4f3572a3281294dfb2003
SHA1

7179c9eaa09685ac063c32d03dc411b17256821d
SHA256

5dbe59453affdbdc633604298c2cfe56d2b6000e12b497db0ca7f9a857e1c948
SHA512

cb0d64888afaec87e453bb61e45efd4af0ee72005dc6b710374b7da99f4e815a2d05750079b1bdb3b76ad20cd25f7bdceb44ec3097e9ee498369208558214cd5
SSDEEP

768:IwyfocomSpfS6q4AIbopY920AzF5vysJoG0sUOh7dm411D4aDzhgpumEcY+ESqKd:Ifp4AIbopsAzOs6c//1D1gAdpSqKW5K

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2204	836	regsvr32.exe	28
PID 836 wrote to memory of 2204	836	regsvr32.exe	28
PID 836 wrote to memory of 2204	836	regsvr32.exe	28
PID 836 wrote to memory of 2204	836	regsvr32.exe	28
PID 836 wrote to memory of 2204	836	regsvr32.exe	28
PID 836 wrote to memory of 2204	836	regsvr32.exe	28
PID 836 wrote to memory of 2204	836	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5dbe59453affdbdc633604298c2cfe56d2b6000e12b497db0ca7f9a857e1c948.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5dbe59453affdbdc633604298c2cfe56d2b6000e12b497db0ca7f9a857e1c948.dll
  2⤵
  PID:2204

memory/2204-0-0x0000000000220000-0x0000000000234000-memory.dmp

Filesize
80KB

Download