13e35736a8afdb2098d36e724ae86b7d9a0404d5e70138d6099662b22defe05f

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 07:33

Target

13e35736a8afdb2098d36e724ae86b7d9a0404d5e70138d6099662b22defe05f.dll
Size

192KB
MD5

58224b6a379e84ccbf44cccb45f81927
SHA1

98046dda5cb55632948947175dda4f124175f637
SHA256

13e35736a8afdb2098d36e724ae86b7d9a0404d5e70138d6099662b22defe05f
SHA512

67455aadc3b4031b35808c0df72d90107f20302d21c0a3555986f780851cb85bebd3b454a0339ee7596fd84890598a97f0e59506ae6916d55059a8caee5ce2c2
SSDEEP

3072:ubLUHMdyidYzaPWgwYMWWLsvcdQJ0IEpgtg9HguPt+AFqnPJ8D4t:unzdRdYzSxMWWgUdrXpgtw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1620	1612	regsvr32.exe	26
PID 1612 wrote to memory of 1620	1612	regsvr32.exe	26
PID 1612 wrote to memory of 1620	1612	regsvr32.exe	26
PID 1612 wrote to memory of 1620	1612	regsvr32.exe	26
PID 1612 wrote to memory of 1620	1612	regsvr32.exe	26
PID 1612 wrote to memory of 1620	1612	regsvr32.exe	26
PID 1612 wrote to memory of 1620	1612	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\13e35736a8afdb2098d36e724ae86b7d9a0404d5e70138d6099662b22defe05f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\13e35736a8afdb2098d36e724ae86b7d9a0404d5e70138d6099662b22defe05f.dll
  2⤵
  PID:1620

memory/1612-54-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

Filesize
8KB

Download
memory/1620-56-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1620-57-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download