ce5c3e38dd516b515070b7450ec99b65d9536e4337bdb234d9e8ddf37a88f680

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 12:03

Target

ce5c3e38dd516b515070b7450ec99b65d9536e4337bdb234d9e8ddf37a88f680.dll
Size

1.3MB
MD5

2038182ae706ed3dfcd969f750adad60
SHA1

b1124e75619ea6be14c52f149f186ee1fffba19a
SHA256

ce5c3e38dd516b515070b7450ec99b65d9536e4337bdb234d9e8ddf37a88f680
SHA512

471dddcc3a404b1f397effe6849b4c40a9c7d0f79f3fecf632348ed9643d9f57b61bfc8d905c376e741975de5b4df9765c35c6314c2b87176a73244441aebfc7
SSDEEP

24576:V66L2gD/uWpFMFn/DBG3NLav0xliPzIJeaItIGPlw:V69gaWpFmkVljiLIytI4l

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ce5c3e38dd516b515070b7450ec99b65d9536e4337bdb234d9e8ddf37a88f680.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ce5c3e38dd516b515070b7450ec99b65d9536e4337bdb234d9e8ddf37a88f680.dll
  2⤵
  PID:1112

memory/1112-56-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1128-54-0x000007FEFC591000-0x000007FEFC593000-memory.dmp

Filesize
8KB

Download