b99c596ded5dd484d91eefd3760b9ea74a7df22e91b0a0a8f5c1d52f1c364464

Analysis

max time kernel
27s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 12:05

Target

b99c596ded5dd484d91eefd3760b9ea74a7df22e91b0a0a8f5c1d52f1c364464.dll
Size

652KB
MD5

196f402be777d20c3df821e79f334490
SHA1

e147a3831729c0437b632dfd2ef620975c113e45
SHA256

b99c596ded5dd484d91eefd3760b9ea74a7df22e91b0a0a8f5c1d52f1c364464
SHA512

2852c8baa2b5f99d8213fafea527a46bd8483c9ed8d2136c7fac0c5c239d7a33508614ced40cc80b09ecf6ac7a1ae15f6f31d32f0a62c6850e0d1dc9d4310d98
SSDEEP

12288:ZQLMFyuwEiuBY8ER5uBj4uX7BlfDd0QC/3oRIUJuNEKqq1wBiJhZ7MQeUYRvXH3Z:ZQowLuBY8OCP7BlfD+f/3oRIUJuNEKqr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2044	1032	regsvr32.exe	28
PID 1032 wrote to memory of 2044	1032	regsvr32.exe	28
PID 1032 wrote to memory of 2044	1032	regsvr32.exe	28
PID 1032 wrote to memory of 2044	1032	regsvr32.exe	28
PID 1032 wrote to memory of 2044	1032	regsvr32.exe	28
PID 1032 wrote to memory of 2044	1032	regsvr32.exe	28
PID 1032 wrote to memory of 2044	1032	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b99c596ded5dd484d91eefd3760b9ea74a7df22e91b0a0a8f5c1d52f1c364464.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b99c596ded5dd484d91eefd3760b9ea74a7df22e91b0a0a8f5c1d52f1c364464.dll
  2⤵
  PID:2044

memory/1032-54-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Filesize
8KB

Download
memory/2044-55-0x0000000000000000-mapping.dmp

Download
memory/2044-56-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download