d049dae3713d32ba72b916c9670554adf533d2ec6f63526f060224b43a8e0dbf

Analysis

max time kernel
26s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-08-2022 13:38

Target

LOCALES/MSAUDDEC.dll
Size

449KB
MD5

76d6aa7eac676315dfc00e17311a3cc5
SHA1

3cd60b77e354a46b9c0e103218edcd2fdb2567ae
SHA256

d245da122919f6b13f16d14ceda814518802864819df21961a5e10771dcae5fa
SHA512

896584c1518fdd25730157b319d2edb90dce5af70cac25f7ccc156df8bbc65120e6e5cf7d9a1c967c9907b59a97c0a017f8d6f6ff5e129334d9270725d1ed362
SSDEEP

12288:m8tEJTKnRGiBf4TuGVCNv1sE+T5fvmpHwVJon88tVksu5Q26t7XN:mnmnRJt4+T+T5fvwwVJonLu5Q26tzN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1592 wrote to memory of 1952	1592	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 1952	1592	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 1952	1592	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 1952	1592	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 1952	1592	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 1952	1592	regsvr32.exe	regsvr32.exe
PID 1592 wrote to memory of 1952	1592	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\LOCALES\MSAUDDEC.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1592

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\LOCALES\MSAUDDEC.dll
2⤵
PID:1952

memory/1592-54-0x000007FEFBD71000-0x000007FEFBD73000-memory.dmp

Filesize
8KB

Download
memory/1952-55-0x0000000000000000-mapping.dmp

Download
memory/1952-56-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download