f1f0aedc4793cbdd4f30b687a242d0160c82f1d62083c6f07c3ed5ea21c5e323

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 18:27

Target

f1f0aedc4793cbdd4f30b687a242d0160c82f1d62083c6f07c3ed5ea21c5e323.dll
Size

88KB
MD5

64cf2deba92a05cb3d70710ea307cdc0
SHA1

350f227b13bba05c96d2cf0d52eefd5237aa7e1f
SHA256

f1f0aedc4793cbdd4f30b687a242d0160c82f1d62083c6f07c3ed5ea21c5e323
SHA512

4080a7e23dc4141e6ea23d73e8194aace5176f00c16a9f7be4e032909bf2e1bea3b4db3dd92013f7dd03be799173099b0dc377a60427b77d32bb0ab428a60d2e
SSDEEP

1536:FL7+rfix7kI37Icx3A/W5WD8CYOLCGbjuZ4DtGvK1V2BueYd1Qb3230NMo2KMx/P:tKWxY80G3YsOLNCZ4YNue81mG3yqRP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1964	748	regsvr32.exe	27
PID 748 wrote to memory of 1964	748	regsvr32.exe	27
PID 748 wrote to memory of 1964	748	regsvr32.exe	27
PID 748 wrote to memory of 1964	748	regsvr32.exe	27
PID 748 wrote to memory of 1964	748	regsvr32.exe	27
PID 748 wrote to memory of 1964	748	regsvr32.exe	27
PID 748 wrote to memory of 1964	748	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f1f0aedc4793cbdd4f30b687a242d0160c82f1d62083c6f07c3ed5ea21c5e323.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f1f0aedc4793cbdd4f30b687a242d0160c82f1d62083c6f07c3ed5ea21c5e323.dll
  2⤵
  PID:1964

memory/748-54-0x000007FEFBD71000-0x000007FEFBD73000-memory.dmp

Filesize
8KB

Download
memory/1964-56-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download