5ffd1c2cf286a7cc5d1914e6ccf8d8b5b5a65c5a7fc2af9af54106ca5a09918e

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 14:45

Target

carcasses/unextradited.dll
Size

561KB
MD5

c0a85dc1b26d37e9811a9c29595d2a6d
SHA1

6c742e64f6ce3533143a453eb67f714a33a41e5c
SHA256

78ea0528d1ffe2591a69bb0a637fc234096fa29b55652c2490c571a845fa8801
SHA512

7ad5653ef71a096b2ff568868514d2f176851dea551b5b0341ba090a15caf919dc75a89f2488c720ee82e1815c3139c369e953ea28b467d6e69b4d39a8069842
SSDEEP

6144:ypIe6W8uc0KxlK9gpC1d88LKXWAOkuL9P5Qt6frqLwYzbn4NKToC2HD9qFmq:yptV8uc0KS9gpC1GIpv9PmgfKP1KJq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1124	1468	regsvr32.exe	27
PID 1468 wrote to memory of 1124	1468	regsvr32.exe	27
PID 1468 wrote to memory of 1124	1468	regsvr32.exe	27
PID 1468 wrote to memory of 1124	1468	regsvr32.exe	27
PID 1468 wrote to memory of 1124	1468	regsvr32.exe	27
PID 1468 wrote to memory of 1124	1468	regsvr32.exe	27
PID 1468 wrote to memory of 1124	1468	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\carcasses\unextradited.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\carcasses\unextradited.dll
  2⤵
  PID:1124

memory/1124-56-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1124-57-0x0000000074F80000-0x0000000075010000-memory.dmp

Filesize
576KB

Download
memory/1124-58-0x0000000074F80000-0x0000000075010000-memory.dmp

Filesize
576KB

Download
memory/1468-54-0x000007FEFC5A1000-0x000007FEFC5A3000-memory.dmp

Filesize
8KB

Download