e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 11:11

Target

e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452.dll
Size

120KB
MD5

629242bce7ed1b4514de65a45aa22ec2
SHA1

0ff110fac76aab7923aeaac8eb4991495678a8ff
SHA256

e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452
SHA512

4ea8bebe96ec43cb7691f6ccbf448b3415c7bbc9d2a4dbcdde7570351cda9a64a95d8339100972ee0c83d8389d8735c6b3297e15a10c4d8f0ad2f195f630d669
SSDEEP

1536:DoqWQ4AAp40cfnUkN2NxQVbtMXBXoyoOKNz78O:yxAN0mUdMMIP7n

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1968	1960	regsvr32.exe	28
PID 1960 wrote to memory of 1968	1960	regsvr32.exe	28
PID 1960 wrote to memory of 1968	1960	regsvr32.exe	28
PID 1960 wrote to memory of 1968	1960	regsvr32.exe	28
PID 1960 wrote to memory of 1968	1960	regsvr32.exe	28
PID 1960 wrote to memory of 1968	1960	regsvr32.exe	28
PID 1960 wrote to memory of 1968	1960	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452.dll
  2⤵
  PID:1968

memory/1960-54-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Filesize
8KB

Download
memory/1968-56-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download