86376681ac5212180d3fa2c2dba2131a4f9bdb2af5ec3299919cde3f67e7410e

Analysis

max time kernel
36s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 12:58

Target

86376681ac5212180d3fa2c2dba2131a4f9bdb2af5ec3299919cde3f67e7410e.dll
Size

72KB
MD5

7d23743ea756da22d24153413d2408ae
SHA1

4361fd71a71f319cc54ae63c0df859800879ab33
SHA256

86376681ac5212180d3fa2c2dba2131a4f9bdb2af5ec3299919cde3f67e7410e
SHA512

a569dee2c22dbcd21ccd69ea822574b88675d02312ec51c3aefe87e970ab752239d6ca9269fd381237b73124772bad5a89b6d27b8480f59326c2039f47498521
SSDEEP

768:nxbiRs43ImYY2uXZ9hAVaAAStKIZ+2fJcwqVETAz4HMBbsjubRGPZMoJdc:OsjY2IGI7IZ+nVETAzFsu9foJ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1020	1168	regsvr32.exe	27
PID 1168 wrote to memory of 1020	1168	regsvr32.exe	27
PID 1168 wrote to memory of 1020	1168	regsvr32.exe	27
PID 1168 wrote to memory of 1020	1168	regsvr32.exe	27
PID 1168 wrote to memory of 1020	1168	regsvr32.exe	27
PID 1168 wrote to memory of 1020	1168	regsvr32.exe	27
PID 1168 wrote to memory of 1020	1168	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\86376681ac5212180d3fa2c2dba2131a4f9bdb2af5ec3299919cde3f67e7410e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\86376681ac5212180d3fa2c2dba2131a4f9bdb2af5ec3299919cde3f67e7410e.dll
  2⤵
  PID:1020

memory/1020-56-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1168-54-0x000007FEFB5C1000-0x000007FEFB5C3000-memory.dmp

Filesize
8KB

Download