c9ccb7e4a9028dd9667fca7e83cde73108669097409c431f0be3aacb43cd4d8d

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 22:37

Target

c9ccb7e4a9028dd9667fca7e83cde73108669097409c431f0be3aacb43cd4d8d.dll
Size

881KB
MD5

606cf2e7ba7a7f50038e0a07bf491710
SHA1

ee25769c8534e496d265b30a1187072e9c470be9
SHA256

c9ccb7e4a9028dd9667fca7e83cde73108669097409c431f0be3aacb43cd4d8d
SHA512

dc4988ff8353495373720585745d437846aa3ea7a00c391dfd3853154e824124218e6e5ebf5b636caedbb5317ebef8312063821cec8383734e5b0f782dd4ee76
SSDEEP

24576:oRTCAIL5zy+hgCY2C21h+hUlK0ZOG+l4kyrIkXE8nu:o4O+WCZCGlK0ZOGM4nIkXE8nu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1160	1976	regsvr32.exe	27
PID 1976 wrote to memory of 1160	1976	regsvr32.exe	27
PID 1976 wrote to memory of 1160	1976	regsvr32.exe	27
PID 1976 wrote to memory of 1160	1976	regsvr32.exe	27
PID 1976 wrote to memory of 1160	1976	regsvr32.exe	27
PID 1976 wrote to memory of 1160	1976	regsvr32.exe	27
PID 1976 wrote to memory of 1160	1976	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c9ccb7e4a9028dd9667fca7e83cde73108669097409c431f0be3aacb43cd4d8d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c9ccb7e4a9028dd9667fca7e83cde73108669097409c431f0be3aacb43cd4d8d.dll
  2⤵
  PID:1160

memory/1160-56-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1976-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Filesize
8KB

Download