9b1becaae353cfed426aac596fdaee9a343dffbdae42e3be55f245cd16be4b6a

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 11:27

Target

ACodec.dll
Size

196KB
MD5

33f12e40ac02640c66f65843a98ed647
SHA1

b7f115dd4cfb3efa87645f33cf418573781c4829
SHA256

ccf3b8b6acf1a0a6a1fb6bb64d51dbbacd48711e4829f8ca6a9033eb358ff627
SHA512

652dcc77f4e71376aea7de4260f30a11e7bf821bad4adb4ce5d850fc669ef33024409632c36a16a5645651c95c20650ade80bbb9637f10ca5fddc6aef7386f11
SSDEEP

3072:teKONHZezSBVOnRD+XaDKfMOaDmcf7QXZrvy/9HmgqPuNks2JD2eLfa2ksFuDa9e:thz2XKiaD+XpqmgguNkN4QJk2u2F9u2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2740 wrote to memory of 1948	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 1948	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 1948	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 1948	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 1948	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 1948	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 1948	2740	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ACodec.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\ACodec.dll
2⤵
PID:1948