6124033fb0ddf5e242de9fb231e7772df0e584ebeb4c94074b9dc18fe3dd4b74

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 12:15

Target

6124033fb0ddf5e242de9fb231e7772df0e584ebeb4c94074b9dc18fe3dd4b74.dll
Size

280KB
MD5

4dd1f8381f4bcf743d15ef1c7b44faee
SHA1

fb08e90f70458e2548203b45ee7218f5067765ea
SHA256

6124033fb0ddf5e242de9fb231e7772df0e584ebeb4c94074b9dc18fe3dd4b74
SHA512

165c89eb4c21bd240e4b9bc7753a99af04a3910d591315b10b1bec13cd9dd2a825d348ea2f3182dcb95a4b89fbe74c9aa2ac6daf5b2ff164e29e55493abaec0a
SSDEEP

6144:ZqKtWPg0q683f085Z41k4HDLQ3alhOa6J9wnMsPwD2THxIeM4KLJZq/8l4N97s:ZhtWfv/OhsPwDss4K94y4o

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6124033fb0ddf5e242de9fb231e7772df0e584ebeb4c94074b9dc18fe3dd4b74.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6124033fb0ddf5e242de9fb231e7772df0e584ebeb4c94074b9dc18fe3dd4b74.dll
  2⤵
  PID:1112

memory/1112-56-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1128-54-0x000007FEFC591000-0x000007FEFC593000-memory.dmp

Filesize
8KB

Download