224ba9fe747ed7266a392961586db8a716553b85760fe3083e6d345034868d8f

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 05:20

Target

224ba9fe747ed7266a392961586db8a716553b85760fe3083e6d345034868d8f.dll
Size

2.9MB
MD5

6ff985653d41e8d60bb1293f01729adf
SHA1

1ae3086a16a91ea45c06d34071d8b3b87e058804
SHA256

224ba9fe747ed7266a392961586db8a716553b85760fe3083e6d345034868d8f
SHA512

fd47a81000dcd98adc03d1f45a172c19b2e8aa3c8f13338bda0b00407f7b81b52e0fa9be3f9ef87fb1303231225e83b9dd8c39a0777ee56ccd54abc52d095b87
SSDEEP

24576:fZJJSVBjkvvhwVxKKpQgRQ8sUOwDUsHeHfcKtaPRO/o5o4Z/5rLyv+Fe:xJegvvhTKTRcPDqho4F5rLyW4

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2504	2076	regsvr32.exe	30
PID 2076 wrote to memory of 2504	2076	regsvr32.exe	30
PID 2076 wrote to memory of 2504	2076	regsvr32.exe	30
PID 2076 wrote to memory of 2504	2076	regsvr32.exe	30
PID 2076 wrote to memory of 2504	2076	regsvr32.exe	30
PID 2076 wrote to memory of 2504	2076	regsvr32.exe	30
PID 2076 wrote to memory of 2504	2076	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\224ba9fe747ed7266a392961586db8a716553b85760fe3083e6d345034868d8f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\224ba9fe747ed7266a392961586db8a716553b85760fe3083e6d345034868d8f.dll
  2⤵
  PID:2504