09e65a661e85c3a3ab0e848809e44f20332b9f46cf5da364c7c8d3992c957f85

Resubmissions

17-06-2024 17:37

14-06-2024 20:15

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 17:37

Target

AppUtil.dll
Size

1.5MB
MD5

7e489e7300d3177f64db31665a2079e0
SHA1

50b20f0b4e5bb5b35e68dd90a5c465dffd30260e
SHA256

7a426359908ae2b6ca1bc8a2773269a48126c2db23c171bc56a3456da4f0016c
SHA512

0b3b34c0e5e095dfd77d801cd7e85e0431da23bf1c943aacb855a40f5a0d9439d7667718abe654eac17ed474b3c9eb644b90cc8cc215c9adc99b12e29b7907d3
SSDEEP

24576:gbp2vEtmbb6kMjihOgysnGc7EiHhP2C1oPObTSFXhPq2QWv/Ec+M6em:gbpLtmbe7dSvAObTAXhPq2QW3Ec+M6em

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2808 wrote to memory of 3048	2808	regsvr32.exe	regsvr32.exe
PID 2808 wrote to memory of 3048	2808	regsvr32.exe	regsvr32.exe
PID 2808 wrote to memory of 3048	2808	regsvr32.exe	regsvr32.exe
PID 2808 wrote to memory of 3048	2808	regsvr32.exe	regsvr32.exe
PID 2808 wrote to memory of 3048	2808	regsvr32.exe	regsvr32.exe
PID 2808 wrote to memory of 3048	2808	regsvr32.exe	regsvr32.exe
PID 2808 wrote to memory of 3048	2808	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AppUtil.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2808

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\AppUtil.dll
2⤵
PID:3048