0bfb4da03f6760ea9b24ee8e2b101ceee93fbfb3e9f3be1ecd55645690103df9

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 05:36

Target

0bfb4da03f6760ea9b24ee8e2b101ceee93fbfb3e9f3be1ecd55645690103df9.dll
Size

128KB
MD5

342fb27ff4831b3a7000170fea897a66
SHA1

4adc0ba6dac2937af6eccbca257cfdbe25cf1961
SHA256

0bfb4da03f6760ea9b24ee8e2b101ceee93fbfb3e9f3be1ecd55645690103df9
SHA512

ca7cd8712e716ef8bcb5dd11e7065041f5a3fbd97318997f423755a1253c1b0e081ea1b5027c819fa18eab53d86c034672ea716c1d8921c759c7245d6ffb7a27
SSDEEP

3072:OdEdnvOjI0evGkPTFEUuEU78WG0RO9uQoFEw/7rG9KVuaduMyZFzLr2n5lhRTY1:D0ROQYSyfj25HR+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 1888	992	regsvr32.exe	27
PID 992 wrote to memory of 1888	992	regsvr32.exe	27
PID 992 wrote to memory of 1888	992	regsvr32.exe	27
PID 992 wrote to memory of 1888	992	regsvr32.exe	27
PID 992 wrote to memory of 1888	992	regsvr32.exe	27
PID 992 wrote to memory of 1888	992	regsvr32.exe	27
PID 992 wrote to memory of 1888	992	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0bfb4da03f6760ea9b24ee8e2b101ceee93fbfb3e9f3be1ecd55645690103df9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0bfb4da03f6760ea9b24ee8e2b101ceee93fbfb3e9f3be1ecd55645690103df9.dll
  2⤵
  PID:1888

memory/992-54-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Filesize
8KB

Download
memory/1888-56-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download