129308c55bc585412536000136bbcd0936df8e3ade81c3289c79ccb6c662ec4b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 11:59

Target
ford/elmconfig/ELMConfig+DLL/DLL/comdlg32.dll
Size 137KB
Sample240617-n5r1gatepr
SHA256 64c6ee999562961d11af130254ad3ffd24bb725d3c18e7877f9fd362f4936195
MD5 b73809a916e6d7c1ae56f182a2e8f7e2
SHA1 34e4213d8bf0e150d3f50ae0bd3f5b328e1105f5
SHA512 26c28cb6c7e1b47425403ab8850a765ac420dd6474327ce8469376219c830ab46218383d15a73c9ea3a23fc6b5f392ee6e2a1632a1bf644b1bd1a05a4729e333
SSDEEP 3072:3ESIiWD8uq4hCqUt6mqD1gRshBgH/voqJrwo2CocrJbQN6N2TRqEydzdHv2:3ETz566VgRyOJ0oDxQRHH
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 1108	2132	regsvr32.exe	28
PID 2132 wrote to memory of 1108	2132	regsvr32.exe	28
PID 2132 wrote to memory of 1108	2132	regsvr32.exe	28
PID 2132 wrote to memory of 1108	2132	regsvr32.exe	28
PID 2132 wrote to memory of 1108	2132	regsvr32.exe	28
PID 2132 wrote to memory of 1108	2132	regsvr32.exe	28
PID 2132 wrote to memory of 1108	2132	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ford\elmconfig\ELMConfig+DLL\DLL\comdlg32.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ford\elmconfig\ELMConfig+DLL\DLL\comdlg32.dll
  2⤵
  PID:1108