28ed0c5aa370cf899a90613d8b6d598d4f5d896718898fbb1989cf9375fbe079

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 03:38

Target

28ed0c5aa370cf899a90613d8b6d598d4f5d896718898fbb1989cf9375fbe079.dll
Size

31KB
MD5

7acd5eb6181b919e8f74831047987829
SHA1

0ecae8defb312d7cb662944c8a27c8d3ac1b2ae7
SHA256

28ed0c5aa370cf899a90613d8b6d598d4f5d896718898fbb1989cf9375fbe079
SHA512

217ffee23448a3a998c3e8b38ac2042dc35dfe9d83f8911b558df4a4e86cb805d1d146987e83beb008ccdb400db15000ad7366120d9afbbe3455c2b9a9791590
SSDEEP

384:+lhXmpWOFKVZOOFloE+JkgtNclgl5+JBrO+ieGsoanbVWBkc1WmKYJLsyj:sAIOehvMLtwysJseGqbebDLsyj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2020	1720	regsvr32.exe	27
PID 1720 wrote to memory of 2020	1720	regsvr32.exe	27
PID 1720 wrote to memory of 2020	1720	regsvr32.exe	27
PID 1720 wrote to memory of 2020	1720	regsvr32.exe	27
PID 1720 wrote to memory of 2020	1720	regsvr32.exe	27
PID 1720 wrote to memory of 2020	1720	regsvr32.exe	27
PID 1720 wrote to memory of 2020	1720	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\28ed0c5aa370cf899a90613d8b6d598d4f5d896718898fbb1989cf9375fbe079.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\28ed0c5aa370cf899a90613d8b6d598d4f5d896718898fbb1989cf9375fbe079.dll
  2⤵
  PID:2020

memory/1720-54-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

Filesize
8KB

Download
memory/2020-56-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download