ca91daa1437a8cd7c349d600def5ea8feb540ebd665c2e354e460c2b6d64ad4b

Analysis

max time kernel
38s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 12:17

Target

ca91daa1437a8cd7c349d600def5ea8feb540ebd665c2e354e460c2b6d64ad4b.dll
Size

100KB
MD5

6e64b1199242a8eff3fa965ed48debc0
SHA1

3654d8c0df019c5d2239a1e318ef06ebc7bfcf8b
SHA256

ca91daa1437a8cd7c349d600def5ea8feb540ebd665c2e354e460c2b6d64ad4b
SHA512

00fc9db62ec404f55a85bee124149a48d17c380dc4c0dfa9108a9d8c66014e2141c1007227c19cf954f7ae5c788947412c9301ffe3c76c64a8419e2c6bb069c1
SSDEEP

1536:0U/TEE5kmxI5QPS1rHCZO9XIx089oPnjNrxa1VQ4VuBk4hWaOH5YNak:bbEExxI5QqVV9ZPjxSGk44auYNb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 1712	340	regsvr32.exe	27
PID 340 wrote to memory of 1712	340	regsvr32.exe	27
PID 340 wrote to memory of 1712	340	regsvr32.exe	27
PID 340 wrote to memory of 1712	340	regsvr32.exe	27
PID 340 wrote to memory of 1712	340	regsvr32.exe	27
PID 340 wrote to memory of 1712	340	regsvr32.exe	27
PID 340 wrote to memory of 1712	340	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ca91daa1437a8cd7c349d600def5ea8feb540ebd665c2e354e460c2b6d64ad4b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:340
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ca91daa1437a8cd7c349d600def5ea8feb540ebd665c2e354e460c2b6d64ad4b.dll
  2⤵
  PID:1712

memory/340-54-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

Filesize
8KB

Download
memory/1712-56-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download
memory/1712-57-0x0000000000180000-0x00000000001C7000-memory.dmp

Filesize
284KB

Download
memory/1712-58-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download