af538ab1b8bdfbf5b7f1548d72c0d042eb14d0011d796cab266f0671720abb4d

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 17:33

Target

af538ab1b8bdfbf5b7f1548d72c0d042eb14d0011d796cab266f0671720abb4d.dll
Size

768KB
MD5

b196bc4d3bea5b7922b98d9ba9eb8e2b
SHA1

901cee60fba225baf80c976b10dfa1684a73f5ee
SHA256

af538ab1b8bdfbf5b7f1548d72c0d042eb14d0011d796cab266f0671720abb4d
SHA512

6ab517257bb30930d43c8e06fee4c3a6115f40d0f6d808b2d52f358d8cb94d93433cd968f825e7e4eb8fe0eba6949b42e8b4a849dc6f14408dcaa0a1a233e97b
SSDEEP

12288:WP9Fk91nFoMWTbxUW/U56Tsf0zIeUIQBy4xK5eM3mFrq5JvwXT6Jp:WfsLKxUIQBy41qmU5JoDw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1056	1816	regsvr32.exe	27
PID 1816 wrote to memory of 1056	1816	regsvr32.exe	27
PID 1816 wrote to memory of 1056	1816	regsvr32.exe	27
PID 1816 wrote to memory of 1056	1816	regsvr32.exe	27
PID 1816 wrote to memory of 1056	1816	regsvr32.exe	27
PID 1816 wrote to memory of 1056	1816	regsvr32.exe	27
PID 1816 wrote to memory of 1056	1816	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\af538ab1b8bdfbf5b7f1548d72c0d042eb14d0011d796cab266f0671720abb4d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\af538ab1b8bdfbf5b7f1548d72c0d042eb14d0011d796cab266f0671720abb4d.dll
  2⤵
  PID:1056

memory/1056-56-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1816-54-0x000007FEFC001000-0x000007FEFC003000-memory.dmp

Filesize
8KB

Download