99c73faac00c1f42fe5afe75575169e8f18de9eceb29c31b65a56bbba2917bf1

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 09:49

Target

99c73faac00c1f42fe5afe75575169e8f18de9eceb29c31b65a56bbba2917bf1.dll
Size

19KB
MD5

4b42092ab8eb06951c34566f38889ef3
SHA1

0eb06c700754944837049eba578e2f489f79ed5d
SHA256

99c73faac00c1f42fe5afe75575169e8f18de9eceb29c31b65a56bbba2917bf1
SHA512

dc7b96cbca47e03ded2e45401da729c1b5b17fe53b7d1bfa238fbd9f86d9bf39579ac6921c9ce8cfe4b6297d5a15e71bd8c717e5ee5f036e5bc0f65e7648af18
SSDEEP

384:8OWWTEcWK4fgjyqViCe39Q+qJEcniZ6MEVJGk2n08hA8Vw:0c4fVuiC9JNisMgJGg8g

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1936	1500	regsvr32.exe	27
PID 1500 wrote to memory of 1936	1500	regsvr32.exe	27
PID 1500 wrote to memory of 1936	1500	regsvr32.exe	27
PID 1500 wrote to memory of 1936	1500	regsvr32.exe	27
PID 1500 wrote to memory of 1936	1500	regsvr32.exe	27
PID 1500 wrote to memory of 1936	1500	regsvr32.exe	27
PID 1500 wrote to memory of 1936	1500	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\99c73faac00c1f42fe5afe75575169e8f18de9eceb29c31b65a56bbba2917bf1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\99c73faac00c1f42fe5afe75575169e8f18de9eceb29c31b65a56bbba2917bf1.dll
  2⤵
  PID:1936

memory/1500-54-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download
memory/1936-56-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download