f8c193dbb8bfabe66a7d9d2a50e0eaed06c12341a71b78c1bd195846c463af6d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 16:42

Target

传奇辅助工具/plugin/MCI.dll
Size

16KB
MD5

1d9e250b501b9ec658d73ef6e482962a
SHA1

1f3fd563a0b7630f0a78fcf609c28718cdf90efc
SHA256

aa3b308a4fd6c7f58375ac518c64cfc024cdc8b2f49d85e4b68bf985fa3d2860
SHA512

d1d79d5ca8e734473354ab05da5137b163f0806537f24a8030dcc9878ddd738d809e54a4868ff5d79c2af93484bffc1c3f62fa0f9efb4a9263085920c37aa0fe
SSDEEP

192:5GZAWx2oLdUHWDXOJTnsN9J8X0VQNFcbyn5aIqz7L6yOl9BPCr6Toh3rCnWUFxAR:5GZ/LQJTnsN9mWccv7Gy2XPCr663cWo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 1724	2356	regsvr32.exe	28
PID 2356 wrote to memory of 1724	2356	regsvr32.exe	28
PID 2356 wrote to memory of 1724	2356	regsvr32.exe	28
PID 2356 wrote to memory of 1724	2356	regsvr32.exe	28
PID 2356 wrote to memory of 1724	2356	regsvr32.exe	28
PID 2356 wrote to memory of 1724	2356	regsvr32.exe	28
PID 2356 wrote to memory of 1724	2356	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\传奇辅助工具\plugin\MCI.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\传奇辅助工具\plugin\MCI.dll
  2⤵
  PID:1724

memory/1724-0-0x0000000011000000-0x0000000011013000-memory.dmp

Filesize
76KB

Download