67552b0a8f034f3f5e086898fd384a822d5023a08d62ca7503986f6985537501

Analysis

max time kernel
23s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 17:14

Target

67552b0a8f034f3f5e086898fd384a822d5023a08d62ca7503986f6985537501.dll
Size

120KB
MD5

626aaf2554f09c266c9751d88362ac57
SHA1

19e0c0f97ddb4fc1813a1efb42d4b3e0acb7c039
SHA256

67552b0a8f034f3f5e086898fd384a822d5023a08d62ca7503986f6985537501
SHA512

4131b87feef727b7debd71eda761ec094e9aaf171b5cc5993d523fa4b259f2d4a4e9f9e89466c3eda0ce0d2b2fc0a99fc8a6db89f4ea5f05107046ae65946b04
SSDEEP

1536:NJqCQ4dbouOW9uR1WN+I8Pov3daD5gJuv:l/dbFgvG+vov3dMgw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\67552b0a8f034f3f5e086898fd384a822d5023a08d62ca7503986f6985537501.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\67552b0a8f034f3f5e086898fd384a822d5023a08d62ca7503986f6985537501.dll
  2⤵
  PID:1672

memory/1008-54-0x000007FEFB901000-0x000007FEFB903000-memory.dmp

Filesize
8KB

Download
memory/1672-56-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download