9210885dda9facfc569240e788cf6e87ba68a54ebeeab8c707293375f3265073

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 10:01

Target

9210885dda9facfc569240e788cf6e87ba68a54ebeeab8c707293375f3265073 (1).dll
Size

25.9MB
MD5

e663ff1bb6be044d698d15a3bc74b822
SHA1

f67ec8ed6895296fa115e8a4443e41a0dbd733c2
SHA256

9210885dda9facfc569240e788cf6e87ba68a54ebeeab8c707293375f3265073
SHA512

d93fe2f67ce89fa6b8b195f14b9341186a2218ba382100a49c0d96f03a6224247ec3ce69a9928b9e4feee056a13f7b7a157d46d0fe65dd761a578a40e8ed7013
SSDEEP

196608:p5H3zHriM3lONIfjm0S6VFWxtswdO8Nw3MRfW8+IiAp7kz8roTsWbbh7nkMz9ha4:frmKSPoTsWbbh7nkMJRNc4Y/kyZpJIV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2860	2076	regsvr32.exe	28
PID 2076 wrote to memory of 2860	2076	regsvr32.exe	28
PID 2076 wrote to memory of 2860	2076	regsvr32.exe	28
PID 2076 wrote to memory of 2860	2076	regsvr32.exe	28
PID 2076 wrote to memory of 2860	2076	regsvr32.exe	28
PID 2076 wrote to memory of 2860	2076	regsvr32.exe	28
PID 2076 wrote to memory of 2860	2076	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\9210885dda9facfc569240e788cf6e87ba68a54ebeeab8c707293375f3265073 (1).dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\9210885dda9facfc569240e788cf6e87ba68a54ebeeab8c707293375f3265073 (1).dll"
  2⤵
  PID:2860

memory/2860-1-0x0000000010000000-0x0000000011A7E000-memory.dmp

Filesize
26.5MB

Download
memory/2860-2-0x0000000010000000-0x0000000011A7E000-memory.dmp

Filesize
26.5MB

Download
memory/2860-3-0x0000000010000000-0x0000000011A7E000-memory.dmp

Filesize
26.5MB

Download