457c61657b0048c3b5f0793f4d63cbdfe83ccfb9ffc81cc0b805e76fcafea7f4

Analysis

max time kernel
27s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 12:20

Target

457c61657b0048c3b5f0793f4d63cbdfe83ccfb9ffc81cc0b805e76fcafea7f4.dll
Size

167KB
MD5

69aed05c36d7406585c0311524814460
SHA1

c0f23102b0dad9f2023ffbed0e91308c0bc356cf
SHA256

457c61657b0048c3b5f0793f4d63cbdfe83ccfb9ffc81cc0b805e76fcafea7f4
SHA512

2c0c47b0eb0e47461946cc3e5baee8b6e17b946cb6db09bcfa3419e7bb2d010771bc843ccc2bbbd429d7f10c3c0b8f51b832eee7b1dc9bed69ef88f22c63dff3
SSDEEP

1536:EtUQzlcEl/WTylK1ML23bNLylol7LVpgKCzmYTThYfcB+B40R5:EtU8ll9yy+xLV6KCzPhY00S

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1960	1968	regsvr32.exe	28
PID 1968 wrote to memory of 1960	1968	regsvr32.exe	28
PID 1968 wrote to memory of 1960	1968	regsvr32.exe	28
PID 1968 wrote to memory of 1960	1968	regsvr32.exe	28
PID 1968 wrote to memory of 1960	1968	regsvr32.exe	28
PID 1968 wrote to memory of 1960	1968	regsvr32.exe	28
PID 1968 wrote to memory of 1960	1968	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\457c61657b0048c3b5f0793f4d63cbdfe83ccfb9ffc81cc0b805e76fcafea7f4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\457c61657b0048c3b5f0793f4d63cbdfe83ccfb9ffc81cc0b805e76fcafea7f4.dll
  2⤵
  PID:1960

memory/1960-56-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/1968-54-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

Filesize
8KB

Download