74d4f60fb0d1af5dc231a59cf7471051d3b2c0ad3e50cbbaf7dccf64ab75d10f

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 01:50

Target

74d4f60fb0d1af5dc231a59cf7471051d3b2c0ad3e50cbbaf7dccf64ab75d10f.dll
Size

88KB
MD5

481b450980bb5b45383913f99011fd90
SHA1

fe1dd0b92f1da47f67867661e7c93aacf0a12ec5
SHA256

74d4f60fb0d1af5dc231a59cf7471051d3b2c0ad3e50cbbaf7dccf64ab75d10f
SHA512

a2715f2c22fb66359758e9776acbce1daac152fb30f0309cdf5a2d17d25ea0e8be9a2652c89f9c1047733cf74bdbafb487b6d80b390adfb1d4fc705fafe45080
SSDEEP

1536:04QSax7ZRiZ1742lZmjG+qL6e5hT9ik2UmJwWhG:04qzRiZ182nWG+qu6T9xmJwWhG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 824	1380	regsvr32.exe	27
PID 1380 wrote to memory of 824	1380	regsvr32.exe	27
PID 1380 wrote to memory of 824	1380	regsvr32.exe	27
PID 1380 wrote to memory of 824	1380	regsvr32.exe	27
PID 1380 wrote to memory of 824	1380	regsvr32.exe	27
PID 1380 wrote to memory of 824	1380	regsvr32.exe	27
PID 1380 wrote to memory of 824	1380	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\74d4f60fb0d1af5dc231a59cf7471051d3b2c0ad3e50cbbaf7dccf64ab75d10f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\74d4f60fb0d1af5dc231a59cf7471051d3b2c0ad3e50cbbaf7dccf64ab75d10f.dll
  2⤵
  PID:824

memory/824-56-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/824-57-0x00000000001F0000-0x00000000001F5000-memory.dmp

Filesize
20KB

Download
memory/1380-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Filesize
8KB

Download