d074441c881b5ba2b3f238a730edbb942b0dfb97114e1a06ebd4872282a654ef

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 01:46

Target

fud crypto/BCSAutogen.dll
Size

48KB
MD5

16e35e8821dc8d90348f274efa941792
SHA1

698599ee94bf4e4c271e989699e288bbd5fc31e3
SHA256

c37325c2ce7803f93033090a477df7a8588d5a1cdef6cc0cea44e299bf8da989
SHA512

879dd4c8cd4bdf4ffbbb6affd259ff47bf4077e6686808a91b10fc0fdb234139dc3ed69e40ce3ca31f0b0bb1d7ea940fd0b6c0317e0865883eb2283c50abfdc9
SSDEEP

768:OmA/lY8mNiYiVvpT/Ix7Y40DX/AdFepp83LSw2eAOswwbz64cROMi2jpv:mlYH6vdw0/AS+WeAOsfbz64g595

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 1276	596	regsvr32.exe	31
PID 596 wrote to memory of 1276	596	regsvr32.exe	31
PID 596 wrote to memory of 1276	596	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\fud crypto\BCSAutogen.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:596
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 596 -s 224
  2⤵
  PID:1276