3c72f2851f20fee1e57a73226a2d4a54d88f55fbcaa817bac22eaf01cb79c8de

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 08:55

Target

$WINDIR/System32/MP3IFilter.dll
Size

144KB
MD5

812b0c669fba023dc9a057371e867528
SHA1

c1fa9956748571f184f1219d9d0cbf421fb8c71f
SHA256

c45f1502a712ee2a4ba66eb0c3fd2ba58ab30a1b0ac78e643e8ed84042354482
SHA512

9e223098e1d51bf40dbbac61dce8b110e2fd4fe73b4cf31c199e7ee135628d340ddde53aa5c95fbc39e30f323d62abce981b93d29f2e40b5cc424284abe4f197
SSDEEP

1536:qFCKwvz+Y8n8QiCfQOHqjiCtUacg7zZTR7rkNJrW4JbrZzzoMKeArPjeoX:qFCFz+Y8nFf1HnCyjgSjZzzojrPjeoX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1256	1288	regsvr32.exe	28
PID 1288 wrote to memory of 1256	1288	regsvr32.exe	28
PID 1288 wrote to memory of 1256	1288	regsvr32.exe	28
PID 1288 wrote to memory of 1256	1288	regsvr32.exe	28
PID 1288 wrote to memory of 1256	1288	regsvr32.exe	28
PID 1288 wrote to memory of 1256	1288	regsvr32.exe	28
PID 1288 wrote to memory of 1256	1288	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$WINDIR\System32\MP3IFilter.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$WINDIR\System32\MP3IFilter.dll
  2⤵
  PID:1256