e28be425b6fdb939a820b07019030b1f53adc56ade3c475f20279e946ccfd377

Analysis

max time kernel
35s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 12:00

Target

e28be425b6fdb939a820b07019030b1f53adc56ade3c475f20279e946ccfd377.dll
Size

128KB
MD5

6f1933b2e37fa1b20fe8b070ea1761e2
SHA1

c08e42ab78fdfd127cb40edfc8d8c705cd044599
SHA256

e28be425b6fdb939a820b07019030b1f53adc56ade3c475f20279e946ccfd377
SHA512

9d21e674888e4797ae0368bff9331436c0018dfa896e151a22569ac900090418eed5235fb7f1f1b4ccd5be03420545814d966d4f7ad1b31d043ace6f366faf2e
SSDEEP

1536:rUgJ+bIg2rWyvmULwsQqdnITBNQIZnCLzsbA6:rprWyv7wc8iItCLzsbH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1092	2044	regsvr32.exe	27
PID 2044 wrote to memory of 1092	2044	regsvr32.exe	27
PID 2044 wrote to memory of 1092	2044	regsvr32.exe	27
PID 2044 wrote to memory of 1092	2044	regsvr32.exe	27
PID 2044 wrote to memory of 1092	2044	regsvr32.exe	27
PID 2044 wrote to memory of 1092	2044	regsvr32.exe	27
PID 2044 wrote to memory of 1092	2044	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e28be425b6fdb939a820b07019030b1f53adc56ade3c475f20279e946ccfd377.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e28be425b6fdb939a820b07019030b1f53adc56ade3c475f20279e946ccfd377.dll
  2⤵
  PID:1092

memory/1092-56-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/2044-54-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Filesize
8KB

Download