f33817b29ed0782e1e8cbec452a45a84a5d0dc8e724fd4cb6965adc0800eeed2

Analysis

max time kernel
29s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 23:03

Target

f33817b29ed0782e1e8cbec452a45a84a5d0dc8e724fd4cb6965adc0800eeed2.dll
Size

120KB
MD5

6e676e8bd7ead7cfbfcfbbcbfbd45217
SHA1

00f36114979bb1791e6cf4163a9ff2f968e351b0
SHA256

f33817b29ed0782e1e8cbec452a45a84a5d0dc8e724fd4cb6965adc0800eeed2
SHA512

64edb1b1e8fcae2bc9a6d2e9b8f66bb22bb5e833bcbde0f605241deb03588236d92b69190f0aced6e1bb81f586d4c914f364bd95ed9e3bd769e131b45932eac0
SSDEEP

1536:z01RqWQYf1xH9WtKCW4WIXgRRmeq0ffShBU8qubTx2w:ApRfrcECnWIXcme5fSA85lX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 952	1928	regsvr32.exe	27
PID 1928 wrote to memory of 952	1928	regsvr32.exe	27
PID 1928 wrote to memory of 952	1928	regsvr32.exe	27
PID 1928 wrote to memory of 952	1928	regsvr32.exe	27
PID 1928 wrote to memory of 952	1928	regsvr32.exe	27
PID 1928 wrote to memory of 952	1928	regsvr32.exe	27
PID 1928 wrote to memory of 952	1928	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f33817b29ed0782e1e8cbec452a45a84a5d0dc8e724fd4cb6965adc0800eeed2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f33817b29ed0782e1e8cbec452a45a84a5d0dc8e724fd4cb6965adc0800eeed2.dll
  2⤵
  PID:952

memory/952-56-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/952-57-0x00000000001C0000-0x00000000001DE000-memory.dmp

Filesize
120KB

Download
memory/1928-54-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Filesize
8KB

Download