e9e96bfcecf2f4fdc536cb0e8b1b2a08cb660f4b73a87099deeb7cbf0cb62210

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 08:36

Target

access.dll
Size

52KB
MD5

68557856c6851353c1578b7cb5b4e71e
SHA1

53596c8a185143fca8cb3890155369b6495aebad
SHA256

e62eea6b342443b075fe1cedebf2eba82448524197abce17263d2d00cc0aed61
SHA512

f84e7a169c0b52be5d261d2e6c49b030443760b82a3e3437e1281c7f98d46345f8519309471f97dc80aa42d7d18ba4b8e80d07681c48ead0ef26e5732eb3f24b
SSDEEP

384:BXzN3gJdY59tTulkbETxYJx6y2DfiqoYBUcz837yI4h9lxovS1fJuUIiho38o8OP:BjmwTulXtEOfZBe7kHovsJI38od54

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1384 wrote to memory of 2144	1384	regsvr32.exe	regsvr32.exe
PID 1384 wrote to memory of 2144	1384	regsvr32.exe	regsvr32.exe
PID 1384 wrote to memory of 2144	1384	regsvr32.exe	regsvr32.exe
PID 1384 wrote to memory of 2144	1384	regsvr32.exe	regsvr32.exe
PID 1384 wrote to memory of 2144	1384	regsvr32.exe	regsvr32.exe
PID 1384 wrote to memory of 2144	1384	regsvr32.exe	regsvr32.exe
PID 1384 wrote to memory of 2144	1384	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\access.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1384

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\access.dll
2⤵
PID:2144