3f8ec3ac729285705bbeff69bad1edada368ef5241d91d3eee878e4b0856bf52

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 21:21

Target

泽华音乐/UpdateDownload.dll
Size

536KB
MD5

5b8ce3afe029616f9b913d9c01692f40
SHA1

d7f1e6aef62411d7835c5c4bfdbaa291434eba6d
SHA256

9be9ff23e0ef787fc65d4775d20e00fb235cde38de45c5b418386d0ace76d101
SHA512

b7a1ac5ab35072c689ce36263531547e320a91b20b77ae362ae88dbc31d74360c3f286c2bf74661dd473d01530ad9cf1a764dab964202eba85d27b118135d4cf
SSDEEP

12288:55aqmc0e9ZlT7Jcorq53Sn0rSmM/h3R2cmPJqRWb4G6yd/+jfRGyhmH:2qmc0eHZ7NRWUGnd/+9GOY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2592	1500	regsvr32.exe	28
PID 1500 wrote to memory of 2592	1500	regsvr32.exe	28
PID 1500 wrote to memory of 2592	1500	regsvr32.exe	28
PID 1500 wrote to memory of 2592	1500	regsvr32.exe	28
PID 1500 wrote to memory of 2592	1500	regsvr32.exe	28
PID 1500 wrote to memory of 2592	1500	regsvr32.exe	28
PID 1500 wrote to memory of 2592	1500	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\泽华音乐\UpdateDownload.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\泽华音乐\UpdateDownload.dll
  2⤵
  PID:2592