45db12c53194a50d8892c5823b6bd28e50f4a152494c4d6e3c1c694c0798b8dd

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 11:08

Target

45db12c53194a50d8892c5823b6bd28e50f4a152494c4d6e3c1c694c0798b8dd.dll
Size

81KB
MD5

4271e846f1b6cd502124c2af0d531620
SHA1

319fe0dbc6fbdccb9ffc9b45ef28d4e1f9cd3a56
SHA256

45db12c53194a50d8892c5823b6bd28e50f4a152494c4d6e3c1c694c0798b8dd
SHA512

23f639af0a62fee0a88c2527bc1bdf5ef2154b2dcac2bffe1cce01b325a72caa5460fedab428883379117bda4c11762e96132bfe5160221d60e410addf51f332
SSDEEP

1536:+p1qnTQf6yPPzjoWQtO6w65mQoLaCv5KGjkcOkC8eggGAvN+HPYVF:+wTxynPQtV5P2aCv5KGjkj8ePvN+HPYz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1420	1112	regsvr32.exe	26
PID 1112 wrote to memory of 1420	1112	regsvr32.exe	26
PID 1112 wrote to memory of 1420	1112	regsvr32.exe	26
PID 1112 wrote to memory of 1420	1112	regsvr32.exe	26
PID 1112 wrote to memory of 1420	1112	regsvr32.exe	26
PID 1112 wrote to memory of 1420	1112	regsvr32.exe	26
PID 1112 wrote to memory of 1420	1112	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\45db12c53194a50d8892c5823b6bd28e50f4a152494c4d6e3c1c694c0798b8dd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\45db12c53194a50d8892c5823b6bd28e50f4a152494c4d6e3c1c694c0798b8dd.dll
  2⤵
  PID:1420

memory/1112-54-0x000007FEFBCC1000-0x000007FEFBCC3000-memory.dmp

Filesize
8KB

Download
memory/1420-56-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/1420-57-0x0000000000170000-0x000000000018A000-memory.dmp

Filesize
104KB

Download