fd563cf7c0c862ab910cf558b5a123354b616e84902d277edf09f378ff6f9786

Resubmissions

26-08-2024 07:17

26-08-2024 07:13

max time kernel
1563s
max time network
1563s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 09:43

Target

b28242123ed2cf6000f0aa036844bd29.dll
Size

87KB
MD5

b28242123ed2cf6000f0aa036844bd29
SHA1

915f41a6c59ed743803ea0ddde08927ffd623586
SHA256

fd563cf7c0c862ab910cf558b5a123354b616e84902d277edf09f378ff6f9786
SHA512

08e5966ca90f08c18c582e6c67d71186a6f9c025fc9f78020e1ce202814de094171111b7f3623d81f7371acdf92206446f7c0425e08e8f5f5b6fd969007d9fca
SSDEEP

1536:0A1KsVHBnVJ0T1rFTQHUPx+nVP7ZSRILMZoXyqqEbzPCAdt6rFTc:0A1rVIrFTOUsnVP7sRILgAPCvrFTc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1920 wrote to memory of 3004	1920	regsvr32.exe	regsvr32.exe
PID 1920 wrote to memory of 3004	1920	regsvr32.exe	regsvr32.exe
PID 1920 wrote to memory of 3004	1920	regsvr32.exe	regsvr32.exe
PID 1920 wrote to memory of 3004	1920	regsvr32.exe	regsvr32.exe
PID 1920 wrote to memory of 3004	1920	regsvr32.exe	regsvr32.exe
PID 1920 wrote to memory of 3004	1920	regsvr32.exe	regsvr32.exe
PID 1920 wrote to memory of 3004	1920	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b28242123ed2cf6000f0aa036844bd29.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b28242123ed2cf6000f0aa036844bd29.dll
  2⤵
  PID:3004

memory/3004-0-0x0000000000150000-0x0000000000193000-memory.dmp

Filesize
268KB

Download