9a023260b3534ed87d0a5cf9860a48327d53fdb9cc052a7fee7e7fcf363a59dd

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/09/2022, 14:22

Target

b9bf1da1f7f1393bf0cd52d114695948966cca6d96ba7ea75ef93dea869b1c48.dll
Size

580KB
MD5

4996d66bbab56a876179ee55dde4fc7e
SHA1

290925abbd06a5c78b7250fee1cc21ca7bbab547
SHA256

b9bf1da1f7f1393bf0cd52d114695948966cca6d96ba7ea75ef93dea869b1c48
SHA512

315bb61bd78f31441e4184daf6fac4cf347604c3d2da54776ffce52a893e1f3cc7484f667eeb1afe01380713749b273776c72cc9cf8bddc50b7d03bf7997d719
SSDEEP

12288:I+hod2fxvHcQhUwUSCfZBmAZgTWkUJXzh7f6H:I+hrv8Q0S2ZBX1kUJF7f6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b9bf1da1f7f1393bf0cd52d114695948966cca6d96ba7ea75ef93dea869b1c48.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b9bf1da1f7f1393bf0cd52d114695948966cca6d96ba7ea75ef93dea869b1c48.dll
  2⤵
  PID:1388

memory/1048-54-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download
memory/1388-56-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download