14e547bebaa738b8605ba4182c4379317d121e268f846c0ed3da171375e65fe4

Analysis

max time kernel
33s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 18:03

Target

14e547bebaa738b8605ba4182c4379317d121e268f846c0ed3da171375e65fe4.dll
Size

768KB
MD5

d1aa0f26f557addd45e0d9fa4afecf15
SHA1

f1603f1ddf52391b16ee9e73e68f5dd405ab06b0
SHA256

14e547bebaa738b8605ba4182c4379317d121e268f846c0ed3da171375e65fe4
SHA512

4bb0d259c9c24c8509c9e09901b2b53df383b08249d85bb8d982b52449ffe039f1c9adcea749ae3efea7e5d78feb866825beff074b079cbac57e2eb8d7b1562e
SSDEEP

12288:3PAFc91nFoMWTbpwaDTg993x/f5NAEXpNUqjAaZIABesp:3IYHRbDZNUhOIAh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\14e547bebaa738b8605ba4182c4379317d121e268f846c0ed3da171375e65fe4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\14e547bebaa738b8605ba4182c4379317d121e268f846c0ed3da171375e65fe4.dll
  2⤵
  PID:1672

memory/1008-54-0x000007FEFB901000-0x000007FEFB903000-memory.dmp

Filesize
8KB

Download
memory/1672-56-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1672-60-0x0000000000810000-0x000000000084F000-memory.dmp

Filesize
252KB

Download
memory/1672-63-0x0000000000810000-0x0000000000890000-memory.dmp

Filesize
512KB

Download
memory/1672-64-0x0000000000810000-0x0000000000890000-memory.dmp

Filesize
512KB

Download