914401789c623bbfc608ce1574838a7e3e39fbbbe24c34c15483f67200942c9b

Analysis

max time kernel
1561s
max time network
1564s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 20:39

Target

I386/RSABASE.dll
Size

128KB
MD5

852d7fa41b204454ecdefaeb0b34687e
SHA1

1bc1c0924d8db6cdd1c2130c1db9e97f554ffd93
SHA256

03ce27ae38da904cb749a644cb1f45e662f9df3854ba2b057668d4a97870d7e8
SHA512

664f4a9462c9a06031c1f0416a93f0c2d8893d25f239577da862cf81fe3bbb8eb17912c1caac6fda7d4290f70da6ba4ebcba192f54027cd4156ba66c4e516e62
SSDEEP

1536:xljWnqjAWDOUEob49Pk6uLl98fd7Q0+5fcfyEt101hL8ZqBYfXe4BQqeCuirXJnU:lAeHYuB98OTUfyxL8M2gCuirXtb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2004 wrote to memory of 2092	2004	regsvr32.exe	regsvr32.exe
PID 2004 wrote to memory of 2092	2004	regsvr32.exe	regsvr32.exe
PID 2004 wrote to memory of 2092	2004	regsvr32.exe	regsvr32.exe
PID 2004 wrote to memory of 2092	2004	regsvr32.exe	regsvr32.exe
PID 2004 wrote to memory of 2092	2004	regsvr32.exe	regsvr32.exe
PID 2004 wrote to memory of 2092	2004	regsvr32.exe	regsvr32.exe
PID 2004 wrote to memory of 2092	2004	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\I386\RSABASE.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\I386\RSABASE.dll
  2⤵
  PID:2092