f93aef709ae8779ad7644a1ee67c9dc51333d14fd4809fc58cb79b393460cb64

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 11:06

Target

f93aef709ae8779ad7644a1ee67c9dc51333d14fd4809fc58cb79b393460cb64.dll
Size

116KB
MD5

3d11dd6375f6f3336cafa7876cbba033
SHA1

749ed0c5764832d8a8b7a1c2b0ee965312d63b5d
SHA256

f93aef709ae8779ad7644a1ee67c9dc51333d14fd4809fc58cb79b393460cb64
SHA512

185b4258fc85574a0d5587dd5c9061fe5a56180652ec461935f4325bba622b64cc889b03821da3a76f9d5f02a58c57b4f7cae9eac1d91808f7b6841abe2c998c
SSDEEP

768:Qb/hBQoi5qZO3QOSxodaCbR2Ala562sIJLwYk6R+Qbii/zyMZ/OPdGVs1CWd:C/jQv5qZWQ4NnYPhMFi/zfZWVGVs1r

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1912	1624	regsvr32.exe	28
PID 1624 wrote to memory of 1912	1624	regsvr32.exe	28
PID 1624 wrote to memory of 1912	1624	regsvr32.exe	28
PID 1624 wrote to memory of 1912	1624	regsvr32.exe	28
PID 1624 wrote to memory of 1912	1624	regsvr32.exe	28
PID 1624 wrote to memory of 1912	1624	regsvr32.exe	28
PID 1624 wrote to memory of 1912	1624	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f93aef709ae8779ad7644a1ee67c9dc51333d14fd4809fc58cb79b393460cb64.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f93aef709ae8779ad7644a1ee67c9dc51333d14fd4809fc58cb79b393460cb64.dll
  2⤵
  PID:1912

memory/1624-54-0x000007FEFBB81000-0x000007FEFBB83000-memory.dmp

Filesize
8KB

Download
memory/1912-56-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download