a1f53e3202dd73edd3a8d8d37b4e5671eba6ab26a7793fe6ef65a1f38a0eae18

Analysis

max time kernel
27s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-10-2022 22:21

Target

a1f53e3202dd73edd3a8d8d37b4e5671eba6ab26a7793fe6ef65a1f38a0eae18.dll
Size

24KB
MD5

3fea9d2edf23b0283c7a66c8dea380bd
SHA1

6b18a6e3033fe8fdde7a26d47e62ddcd8aaf18a5
SHA256

a1f53e3202dd73edd3a8d8d37b4e5671eba6ab26a7793fe6ef65a1f38a0eae18
SHA512

0985f6b1f410a8440a45882a5bebc08b1538b52a3eeedaa21a736692d3d3fca2dbba05992a7643f2bde2540e31d87d28bf0ed07fc6a785eee5cc461c0b872bf1
SSDEEP

48:SdrllOC21BEM8ipPI7eOrdwzwnAceVt1FiwVO1nN0wdm6Hn:44BR8ip5OrdwQAc8fW1Zbn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1284	1952	regsvr32.exe	28
PID 1952 wrote to memory of 1284	1952	regsvr32.exe	28
PID 1952 wrote to memory of 1284	1952	regsvr32.exe	28
PID 1952 wrote to memory of 1284	1952	regsvr32.exe	28
PID 1952 wrote to memory of 1284	1952	regsvr32.exe	28
PID 1952 wrote to memory of 1284	1952	regsvr32.exe	28
PID 1952 wrote to memory of 1284	1952	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a1f53e3202dd73edd3a8d8d37b4e5671eba6ab26a7793fe6ef65a1f38a0eae18.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a1f53e3202dd73edd3a8d8d37b4e5671eba6ab26a7793fe6ef65a1f38a0eae18.dll
  2⤵
  PID:1284

memory/1284-55-0x0000000000000000-mapping.dmp

Download
memory/1284-56-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download
memory/1952-54-0x000007FEFC421000-0x000007FEFC423000-memory.dmp

Filesize
8KB

Download