88de34ad95486071b8796d95150461a8a7968d1eb8817772e892d258f3aa1c91

Resubmissions

24-07-2023 06:52

27-10-2022 16:06

31-08-2022 10:16

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31-08-2022 10:16

Target

x.dll
Size

429KB
MD5

f4b0a6ab164f7c58cccce651606caede
SHA1

e893352eb4df504843cb3e8588d59593a9757937
SHA256

88de34ad95486071b8796d95150461a8a7968d1eb8817772e892d258f3aa1c91
SHA512

0a305d740ff8074fb9ed2b501316beee4c33d48f35728665b7fa0f3a2b7b3efb6731ec0e2245e296822a8e640e4f1439c24e1870c4080ac211d4ac11c5de43e5
SSDEEP

12288:yd/Qeei+XrnguJYoeYcWDCkz+oI2u024rn2M24rn2h125HRB:yd//m7nzK262h

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2040	1940	regsvr32.exe	27
PID 1940 wrote to memory of 2040	1940	regsvr32.exe	27
PID 1940 wrote to memory of 2040	1940	regsvr32.exe	27
PID 1940 wrote to memory of 1472	1940	regsvr32.exe	29
PID 1940 wrote to memory of 1472	1940	regsvr32.exe	29
PID 1940 wrote to memory of 1472	1940	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\x.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\system32\cmd.exe
  cmd /c "echo Commands" >> C:\Users\Admin\AppData\Local\Temp\14E4.tmp
  2⤵
  PID:2040
- C:\Windows\system32\cmd.exe
  cmd /c "dir" >> C:\Users\Admin\AppData\Local\Temp\14E4.tmp
  2⤵
  PID:1472

C:\Users\Admin\AppData\Local\Temp\14E4.tmp

Filesize
11B

MD5
a67f2061c697fd95f6b28d89b953a51f

SHA1
6730b864104f0840fcebf04383d2e3ef7c324a48

SHA256
d4bdd82a900fea52cbd442ce8cae201982392d3533d765bfceb7682bc2d16a79

SHA512
d9cc7c1593967dbcaf358bc9d394426d97baa7bb6ddeed1767b638c85aa814276eaa3609588b720cab3b2a0b3e36d1d3833dab3e75c9c1a92b8315db61a64cbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\14E4.tmp

Filesize
3KB

MD5
5eb52e83f8275817f386a8198599d694

SHA1
6209d192ad7aeee07566975bac958df03b389e13

SHA256
f854ba286cc48dab303e59a77440967e90ae09f4cab43370227437f7d6cf942a

SHA512
87f1032d7566a3c32adb7849d6435faeac3229c3e424ce24df9bb6cc27c2e64b043c446d7f63ed40829fd9a4e1063175990859564fff235086075a3d0266b7b1

Download Submit
memory/1472-63-0x0000000000000000-mapping.dmp

Download
memory/1940-54-0x000007FEFC3D1000-0x000007FEFC3D3000-memory.dmp

Filesize
8KB

Download
memory/1940-55-0x000007FEFB8A0000-0x000007FEFB90E000-memory.dmp

Filesize
440KB

Download
memory/1940-56-0x0000000180000000-0x0000000180013000-memory.dmp

Filesize
76KB

Download
memory/2040-62-0x0000000000000000-mapping.dmp

Download