5596dc2185901d13bbd40991e8dbae21b06d5f5f106d7954739718ac3d412a53

Analysis

max time kernel
56s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 13:28

Target

carcasses/full.dll
Size

561KB
MD5

780c8b903eb2f4b57391c3dbe2d8ffa0
SHA1

c7ef52840015e00ea49e80d7bfe5b52abfcc93ca
SHA256

9eaa2e60e4285d5a36128ae4df77abb241befed30d3bbfdadc1925277e582c8a
SHA512

2afdc2364ff110002ae700f488f8e1ab74007887941c9b89aed277354fe1ccd56f8c36199b75b0b3386d66ec11fe4fc9af8a913fdfb6228b003f5415a07002a8
SSDEEP

6144:ypIe6W8uc0KxlK9gpC1d88LKXpAOkuL9P5Qt6frqLwYzbn4NKToC2HD9qFmq:yptV8uc0KS9gpC1GIqv9PmgfKP1KJq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 992	684	regsvr32.exe	28
PID 684 wrote to memory of 992	684	regsvr32.exe	28
PID 684 wrote to memory of 992	684	regsvr32.exe	28
PID 684 wrote to memory of 992	684	regsvr32.exe	28
PID 684 wrote to memory of 992	684	regsvr32.exe	28
PID 684 wrote to memory of 992	684	regsvr32.exe	28
PID 684 wrote to memory of 992	684	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\carcasses\full.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:684
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\carcasses\full.dll
  2⤵
  PID:992

memory/684-54-0x000007FEFC101000-0x000007FEFC103000-memory.dmp

Filesize
8KB

Download
memory/992-56-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/992-57-0x0000000074C80000-0x0000000074D10000-memory.dmp

Filesize
576KB

Download
memory/992-58-0x0000000074C80000-0x0000000074D10000-memory.dmp

Filesize
576KB

Download