c633fa1a970f70d06a8eedb4184f241e6d74d74b24ecf64db116fe521d767f0d

Analysis

max time kernel
15s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 07:59

Target

7164478ee929b224a9243aa0835c0ea0N.dll
Size

446KB
MD5

7164478ee929b224a9243aa0835c0ea0
SHA1

2ae694899a515dc1d42de8f2affd5297358b6350
SHA256

c633fa1a970f70d06a8eedb4184f241e6d74d74b24ecf64db116fe521d767f0d
SHA512

396d2902583de621a916f324e7ed04462134f91592f6d38cd2ce73feeeb7f2d2f984d32329a5737f62262804d6bfd05b660c71ee639b0043c56e763ee65955f1
SSDEEP

12288:Y7SFw7me2ri4C41PJGw+DzF+TE1xMWIQzvsCzFA:eSFwani4aDzF+AnMWIQ7n+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1696	1964	regsvr32.exe	30
PID 1964 wrote to memory of 1696	1964	regsvr32.exe	30
PID 1964 wrote to memory of 1696	1964	regsvr32.exe	30
PID 1964 wrote to memory of 1696	1964	regsvr32.exe	30
PID 1964 wrote to memory of 1696	1964	regsvr32.exe	30
PID 1964 wrote to memory of 1696	1964	regsvr32.exe	30
PID 1964 wrote to memory of 1696	1964	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7164478ee929b224a9243aa0835c0ea0N.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7164478ee929b224a9243aa0835c0ea0N.dll
  2⤵
  PID:1696