f54d75476f2b8b88c0a2265ffaf305e2caeef61f5a8b0fa80f12b801eb048718

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 03:39

Target

f54d75476f2b8b88c0a2265ffaf305e2caeef61f5a8b0fa80f12b801eb048718.dll
Size

1.6MB
MD5

e180df04028e8fdf3d6db4a766291751
SHA1

1b94e85065365d4b97b37bfecbad152a42d7f653
SHA256

f54d75476f2b8b88c0a2265ffaf305e2caeef61f5a8b0fa80f12b801eb048718
SHA512

87cb27683131174eea48e8175d4bb105b28cbdeedeaa6b56bdbd19d71b19e0d7a987b7a85cb56ddda7e725e877afcad39605ba25a03d8762f17ccdef06b72173
SSDEEP

49152:YK8OhN1igMM94bX4N2wTA46hcjB/CrCHG:YeEb88AjhCSG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 3008	1044	regsvr32.exe	28
PID 1044 wrote to memory of 3008	1044	regsvr32.exe	28
PID 1044 wrote to memory of 3008	1044	regsvr32.exe	28
PID 1044 wrote to memory of 3008	1044	regsvr32.exe	28
PID 1044 wrote to memory of 3008	1044	regsvr32.exe	28
PID 1044 wrote to memory of 3008	1044	regsvr32.exe	28
PID 1044 wrote to memory of 3008	1044	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f54d75476f2b8b88c0a2265ffaf305e2caeef61f5a8b0fa80f12b801eb048718.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f54d75476f2b8b88c0a2265ffaf305e2caeef61f5a8b0fa80f12b801eb048718.dll
  2⤵
  PID:3008

memory/3008-0-0x0000000000190000-0x00000000001EE000-memory.dmp

Filesize
376KB

Download
memory/3008-1-0x0000000000190000-0x00000000001EE000-memory.dmp

Filesize
376KB

Download