b08d0cb28c309840283d82c5c273948cf259dbad0223555d991944745ae7f397

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 15:41

Target

b08d0cb28c309840283d82c5c273948cf259dbad0223555d991944745ae7f397.dll
Size

5.8MB
MD5

ae0388b431b03362536f421d6613cf45
SHA1

ce1dfc485557b4d946d40368c9e9da5b69005ec4
SHA256

b08d0cb28c309840283d82c5c273948cf259dbad0223555d991944745ae7f397
SHA512

c4cae1b0bc86948ca1290ceac18679ba68b3bc718096075143a272c738e97b1cfbd1c0d53f2c0aaedb8347ff35b279c99bf1858a21fa3a4101c6b19ce494d2cb
SSDEEP

98304:eBSdpXqs+KMD9ap0aCR6P6E6LRbluERHDzQo:eBSv8wgRblzn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 2088	1240	regsvr32.exe	28
PID 1240 wrote to memory of 2088	1240	regsvr32.exe	28
PID 1240 wrote to memory of 2088	1240	regsvr32.exe	28
PID 1240 wrote to memory of 2088	1240	regsvr32.exe	28
PID 1240 wrote to memory of 2088	1240	regsvr32.exe	28
PID 1240 wrote to memory of 2088	1240	regsvr32.exe	28
PID 1240 wrote to memory of 2088	1240	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b08d0cb28c309840283d82c5c273948cf259dbad0223555d991944745ae7f397.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b08d0cb28c309840283d82c5c273948cf259dbad0223555d991944745ae7f397.dll
  2⤵
  PID:2088