c676bb5d6b1c61192fd8e0b6702b656ca77079b03130a9b72232bda5dcf7a24b

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 17:12

Target

c676bb5d6b1c61192fd8e0b6702b656ca77079b03130a9b72232bda5dcf7a24b.dll
Size

231KB
MD5

64ef9af4f27bdcc011c8bd69d4cf8eb0
SHA1

eba2f51d890a33631b84f6614b8f7d161571ef22
SHA256

c676bb5d6b1c61192fd8e0b6702b656ca77079b03130a9b72232bda5dcf7a24b
SHA512

f7e99e4af5a5a16348e3a8cc0153b6bcef9b83ea2cfc972bb51415d725982313ecf9322ce9a98c3de07a9c15915f2e589d0e13920e451c755288eab8b9aa3ab0
SSDEEP

3072:XVUUW2KzjVUUW2KzjVUUW2KzjVUUW2KzjVUUW2KzjVUUW2KzjVUUW2Kz:XNW9NW9NW9NW9NW9NW9NW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1368	1916	regsvr32.exe	28
PID 1916 wrote to memory of 1368	1916	regsvr32.exe	28
PID 1916 wrote to memory of 1368	1916	regsvr32.exe	28
PID 1916 wrote to memory of 1368	1916	regsvr32.exe	28
PID 1916 wrote to memory of 1368	1916	regsvr32.exe	28
PID 1916 wrote to memory of 1368	1916	regsvr32.exe	28
PID 1916 wrote to memory of 1368	1916	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c676bb5d6b1c61192fd8e0b6702b656ca77079b03130a9b72232bda5dcf7a24b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c676bb5d6b1c61192fd8e0b6702b656ca77079b03130a9b72232bda5dcf7a24b.dll
  2⤵
  PID:1368

memory/1368-56-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1368-57-0x00000000001B0000-0x00000000001BE000-memory.dmp

Filesize
56KB

Download
memory/1916-54-0x000007FEFB901000-0x000007FEFB903000-memory.dmp

Filesize
8KB

Download