489cc0ce8393870d0c7b01891d56e267cecc2edce79e774af996cdcf4fbda411

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
18/10/2022, 17:15

Target

carcasses/peg.dll
Size

561KB
MD5

955bc30695dd32875e5b1f3c6517b935
SHA1

9b5c5d21a15a7e66cc897299296d9f05b0d7d1b9
SHA256

319b660e3224b3c5f9ec19645ef1b05c8c91f70ebe3235d55d4c86f47eccdbbd
SHA512

24f8c0c97bd40520be5499648967c653ea92a1927f833b8d758788242329fec949aefb36b394ba559becfedf799e0ad07c579ad38d7dfb2b1608def27504471d
SSDEEP

6144:ypIe6W8uc0KxlK9gpC1d88LKXeAOkuL9P5Qt6frqLwYzbn4NKToC2HD9qFmq:yptV8uc0KS9gpC1GIBv9PmgfKP1KJq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1276	1448	regsvr32.exe	27
PID 1448 wrote to memory of 1276	1448	regsvr32.exe	27
PID 1448 wrote to memory of 1276	1448	regsvr32.exe	27
PID 1448 wrote to memory of 1276	1448	regsvr32.exe	27
PID 1448 wrote to memory of 1276	1448	regsvr32.exe	27
PID 1448 wrote to memory of 1276	1448	regsvr32.exe	27
PID 1448 wrote to memory of 1276	1448	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\carcasses\peg.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\carcasses\peg.dll
  2⤵
  PID:1276

memory/1276-56-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/1276-57-0x0000000074590000-0x0000000074620000-memory.dmp

Filesize
576KB

Download
memory/1276-58-0x0000000074590000-0x0000000074620000-memory.dmp

Filesize
576KB

Download
memory/1448-54-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp

Filesize
8KB

Download