4c7b44165361e62681372a4c093e4012375233eb568b6ef69ebec57dc31873ea

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 22:57

Target

4c7b44165361e62681372a4c093e4012375233eb568b6ef69ebec57dc31873ea.dll
Size

128KB
MD5

a1fcb9808e288fdfef0408e447eefce3
SHA1

5031d60fa93a1234a6fd9c6de6593af22511d408
SHA256

4c7b44165361e62681372a4c093e4012375233eb568b6ef69ebec57dc31873ea
SHA512

8d3c939cf2027d993fa02b874aa1574b22740ac3dd6745a3b4763270eb497fe1415932076368bff449013aded965c391412204d1bcaf66f70d18c50b91cdcc30
SSDEEP

1536:FUgJ+blg2rWyvmULwsQqdnITBNQIZnCLzsXA6:FcrWyv7wc8iItCLzsXH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1664	1504	regsvr32.exe	28
PID 1504 wrote to memory of 1664	1504	regsvr32.exe	28
PID 1504 wrote to memory of 1664	1504	regsvr32.exe	28
PID 1504 wrote to memory of 1664	1504	regsvr32.exe	28
PID 1504 wrote to memory of 1664	1504	regsvr32.exe	28
PID 1504 wrote to memory of 1664	1504	regsvr32.exe	28
PID 1504 wrote to memory of 1664	1504	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4c7b44165361e62681372a4c093e4012375233eb568b6ef69ebec57dc31873ea.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4c7b44165361e62681372a4c093e4012375233eb568b6ef69ebec57dc31873ea.dll
  2⤵
  PID:1664

memory/1504-54-0x000007FEFBCE1000-0x000007FEFBCE3000-memory.dmp

Filesize
8KB

Download
memory/1664-56-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download