9bb4ab08f32217668397ccc91cd4d9dcf5b415afa8e62c3b41d115aee4a0afbf

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 11:30

Target

b82899fcfd19b52431442b5c30946c40N.dll
Size

406KB
MD5

b82899fcfd19b52431442b5c30946c40
SHA1

c5aaa3148197ab55a408f8a74ef9a5742c8c5e31
SHA256

9bb4ab08f32217668397ccc91cd4d9dcf5b415afa8e62c3b41d115aee4a0afbf
SHA512

96b4b9966c62d6e1cf22f6cbfd7277bfcf89b84e26da45998e85d63e79fa5d66b516a51679e87c8611d2c0456a8dbc0a0fa80ad6fc8cfe090e4c62e310ff01cd
SSDEEP

6144:1lKrwBGXctzr/j8Yu+FD+lD0KXl42IXSwMf/nOw456RIihpe7LJ:br/Ublu2SSRf/nP456AP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2004	2212	regsvr32.exe	30
PID 2212 wrote to memory of 2004	2212	regsvr32.exe	30
PID 2212 wrote to memory of 2004	2212	regsvr32.exe	30
PID 2212 wrote to memory of 2004	2212	regsvr32.exe	30
PID 2212 wrote to memory of 2004	2212	regsvr32.exe	30
PID 2212 wrote to memory of 2004	2212	regsvr32.exe	30
PID 2212 wrote to memory of 2004	2212	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b82899fcfd19b52431442b5c30946c40N.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b82899fcfd19b52431442b5c30946c40N.dll
  2⤵
  PID:2004

memory/2004-0-0x000000007457D000-0x00000000745A0000-memory.dmp

Filesize
140KB

Download