d049dae3713d32ba72b916c9670554adf533d2ec6f63526f060224b43a8e0dbf

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-08-2022 13:38

Target

LOCALES/MSAMRNBD.dll
Size

128KB
MD5

b8575c2ba2ac7255c9c1f2c809bdd730
SHA1

1b22df2dfcc5dc6143f1ec2c852f9ebd814ba5e0
SHA256

d303638cb83a7e2651e74e20db52691805b43fa222f2cc98e2b02cfb8536b8b2
SHA512

93c9955c63a0c9ef4296cea8efb58094332bf8ae1e3f25692ea16fd8893aec31dfafdd4ba70365d08a57a8c1fa121794fa4e2fe0b49c071f425cb5b6405d96e6
SSDEEP

3072:X+iAR5LJm1kvkLJv/c7XgxhSfJJ91LoJcAERJy00PyLvSFVBCo5w/f4EV5T9Xt2:XkRu1wQdcJ/7L0uW0T992

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1800 wrote to memory of 1572	1800	regsvr32.exe	regsvr32.exe
PID 1800 wrote to memory of 1572	1800	regsvr32.exe	regsvr32.exe
PID 1800 wrote to memory of 1572	1800	regsvr32.exe	regsvr32.exe
PID 1800 wrote to memory of 1572	1800	regsvr32.exe	regsvr32.exe
PID 1800 wrote to memory of 1572	1800	regsvr32.exe	regsvr32.exe
PID 1800 wrote to memory of 1572	1800	regsvr32.exe	regsvr32.exe
PID 1800 wrote to memory of 1572	1800	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\LOCALES\MSAMRNBD.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\LOCALES\MSAMRNBD.dll
2⤵
PID:1572

memory/1572-55-0x0000000000000000-mapping.dmp

Download
memory/1572-56-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/1800-54-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Filesize
8KB

Download