c3292a1a8b5708160e8d863844eb20ee0aad7ea0d827cb7bec429c70416f35cf

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 12:44

Target
lib/bin/axbridge.dll
Size 112KB
Sample240603-pypr7sgc32
SHA256 b1a89ea7dfd0594d37cdb84c6f81ba57b5ae8175979a1605474ed3f9e5e8333a
MD5 5d5af89fa4bde3597598d3d5a71a0bc7
SHA1 f08d0b09124300feacf00f4ca9ef667bf0796bb6
SHA512 113a1441a6e7f6e56c892dac9e310675aec275d77269d370beb77cc170a0f426611947495cddee09bc50bb595c70d1f770c6a46db7959196813f96670281158e
SSDEEP 3072:v6TgoneEy94+BZ3N2ov1Azjb+cuc7B/h999VhwR:iMLEy3rqjSLc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 1996	2092	regsvr32.exe	28
PID 2092 wrote to memory of 1996	2092	regsvr32.exe	28
PID 2092 wrote to memory of 1996	2092	regsvr32.exe	28
PID 2092 wrote to memory of 1996	2092	regsvr32.exe	28
PID 2092 wrote to memory of 1996	2092	regsvr32.exe	28
PID 2092 wrote to memory of 1996	2092	regsvr32.exe	28
PID 2092 wrote to memory of 1996	2092	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\lib\bin\axbridge.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\lib\bin\axbridge.dll
  2⤵
  PID:1996