fd563cf7c0c862ab910cf558b5a123354b616e84902d277edf09f378ff6f9786

max time kernel
844s
max time network
844s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 11:00

Sharing

Target

b28242123ed2cf6000f0aa036844bd29.dll
Size

87KB
MD5

b28242123ed2cf6000f0aa036844bd29
SHA1

915f41a6c59ed743803ea0ddde08927ffd623586
SHA256

fd563cf7c0c862ab910cf558b5a123354b616e84902d277edf09f378ff6f9786
SHA512

08e5966ca90f08c18c582e6c67d71186a6f9c025fc9f78020e1ce202814de094171111b7f3623d81f7371acdf92206446f7c0425e08e8f5f5b6fd969007d9fca
SSDEEP

1536:0A1KsVHBnVJ0T1rFTQHUPx+nVP7ZSRILMZoXyqqEbzPCAdt6rFTc:0A1rVIrFTOUsnVP7sRILgAPCvrFTc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	regsvr32.exe
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	regsvr32.exe
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	regsvr32.exe
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	regsvr32.exe
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	regsvr32.exe
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	regsvr32.exe
PID 1976 wrote to memory of 2376	1976	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b28242123ed2cf6000f0aa036844bd29.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\b28242123ed2cf6000f0aa036844bd29.dll
2⤵
PID:2376

memory/2376-0-0x00000000001E0000-0x0000000000223000-memory.dmp

Filesize
268KB

Download