489cc0ce8393870d0c7b01891d56e267cecc2edce79e774af996cdcf4fbda411

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
18/10/2022, 17:15

Target
carcasses/peg.dll
Size 561KB
Sample221018-vsmzbaggfk
SHA256 319b660e3224b3c5f9ec19645ef1b05c8c91f70ebe3235d55d4c86f47eccdbbd
MD5 955bc30695dd32875e5b1f3c6517b935
SHA1 9b5c5d21a15a7e66cc897299296d9f05b0d7d1b9
SHA512 24f8c0c97bd40520be5499648967c653ea92a1927f833b8d758788242329fec949aefb36b394ba559becfedf799e0ad07c579ad38d7dfb2b1608def27504471d
SSDEEP 6144:ypIe6W8uc0KxlK9gpC1d88LKXeAOkuL9P5Qt6frqLwYzbn4NKToC2HD9qFmq:yptV8uc0KS9gpC1GIBv9PmgfKP1KJq
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1276	1448	regsvr32.exe	27
PID 1448 wrote to memory of 1276	1448	regsvr32.exe	27
PID 1448 wrote to memory of 1276	1448	regsvr32.exe	27
PID 1448 wrote to memory of 1276	1448	regsvr32.exe	27
PID 1448 wrote to memory of 1276	1448	regsvr32.exe	27
PID 1448 wrote to memory of 1276	1448	regsvr32.exe	27
PID 1448 wrote to memory of 1276	1448	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\carcasses\peg.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\carcasses\peg.dll
  2⤵
  PID:1276

memory/1276-56-0x00000000758B1000-0x00000000758B3000-memory.dmp

Download

memory/1276-57-0x0000000074590000-0x0000000074620000-memory.dmp

Download

memory/1276-58-0x0000000074590000-0x0000000074620000-memory.dmp

Download

memory/1448-54-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp

Download