841e804ee8334fb03ca41cf760237b8471e0184448ad36a1beeb06b1031f1e56

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 23:39

Target

841e804ee8334fb03ca41cf760237b8471e0184448ad36a1beeb06b1031f1e56.dll
Size

3.2MB
MD5

fb756bf9161ca129a7952fe4e073d624
SHA1

d29e5b57c86a3208122819e5ec4b141d8de54f2d
SHA256

841e804ee8334fb03ca41cf760237b8471e0184448ad36a1beeb06b1031f1e56
SHA512

f9a7654a2a1fbb015a5e072ec945545fa8151a0818e685c21aa229f3b0be431a835f1c671dccc36b18a0d0cd699aff8e4a1cff7331c3d69285d1d259f51771cf
SSDEEP

98304:hePSLgdqU18mXaCXAs7cDc2PR96Ym/aL:hePVYYaCwsJ2PR961/A

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1696	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1696	1652	regsvr32.exe	28
PID 1652 wrote to memory of 1696	1652	regsvr32.exe	28
PID 1652 wrote to memory of 1696	1652	regsvr32.exe	28
PID 1652 wrote to memory of 1696	1652	regsvr32.exe	28
PID 1652 wrote to memory of 1696	1652	regsvr32.exe	28
PID 1652 wrote to memory of 1696	1652	regsvr32.exe	28
PID 1652 wrote to memory of 1696	1652	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\841e804ee8334fb03ca41cf760237b8471e0184448ad36a1beeb06b1031f1e56.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\841e804ee8334fb03ca41cf760237b8471e0184448ad36a1beeb06b1031f1e56.dll
  2⤵
  - Loads dropped DLL
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\2137.tmp
    C:\Users\Admin\AppData\Local\Temp\2137.tmp
    3⤵
    PID:2096

\Users\Admin\AppData\Local\Temp\2137.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
memory/1696-0-0x0000000000330000-0x000000000039B000-memory.dmp

Filesize
428KB

Download
memory/1696-1-0x0000000000330000-0x000000000039B000-memory.dmp

Filesize
428KB

Download
memory/1696-3-0x0000000003480000-0x00000000038C9000-memory.dmp

Filesize
4.3MB

Download