1dd5bf67d2f7e0fc2e95baf84a8bda494668ff304fc6bb910b1c0d58d5a85bee

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 02:31

Target
Components/Community/XLCommunity.dll
Size 1.4MB
Sample240610-czzmksbd97
SHA256 06d30295310777866a3139d625f75d4c2a39a73ed5ecf980d59eb83faa178943
MD5 bc8342373552c1b7b1df8009a9250ca8
SHA1 1e7922b6c30a850ea9c369cdb2b000a289ee0420
SHA512 abb92e69cca1778a03393d3c7563709912343bbec1089eb78a918a23cb17fb8521112cde929467bd828f8104659321de1b54bcf53ec9717ed1525d86cf39569e
SSDEEP 24576:CqUu1OC+h17qoB1hijnVDYDnXSG3jNIsen0LCxT5ZTnPa7C6:CqUgVoBbCpYtzNIsqewTDmC6
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2064	2100	regsvr32.exe	28
PID 2100 wrote to memory of 2064	2100	regsvr32.exe	28
PID 2100 wrote to memory of 2064	2100	regsvr32.exe	28
PID 2100 wrote to memory of 2064	2100	regsvr32.exe	28
PID 2100 wrote to memory of 2064	2100	regsvr32.exe	28
PID 2100 wrote to memory of 2064	2100	regsvr32.exe	28
PID 2100 wrote to memory of 2064	2100	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Components\Community\XLCommunity.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Components\Community\XLCommunity.dll
  2⤵
  PID:2064