6a78e18ccd58f1a1b59b2fa2f48d1af0b74c24432514ca655e0658b6284712f0

Analysis

max time kernel
44s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 19:15

Target

carcasses/auriferous.dll
Size

561KB
MD5

4a25e64658caad3d9854ba8c4bd4499f
SHA1

610e7a11f361e50ca162188a3b93a181359c8ed7
SHA256

9a79361a8a2e549502a8343d371d4606b4978c6bca9bc3481c6796976f510731
SHA512

ec203fb556620c1208f0bd4893a59530a6a1c1cce387913efba0513deae0b40a9ab5d42bad59d2cd8223787addaede1c655f0094dea8fdfdc20bcc417df6ac16
SSDEEP

6144:ypIe6W8uc0KxlK9gpC1d88LKXKAOkuL9P5Qt6frqLwYzbn4NKToC2HD9qFmq:yptV8uc0KS9gpC1GIBv9PmgfKP1KJq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1960	780	regsvr32.exe	28
PID 780 wrote to memory of 1960	780	regsvr32.exe	28
PID 780 wrote to memory of 1960	780	regsvr32.exe	28
PID 780 wrote to memory of 1960	780	regsvr32.exe	28
PID 780 wrote to memory of 1960	780	regsvr32.exe	28
PID 780 wrote to memory of 1960	780	regsvr32.exe	28
PID 780 wrote to memory of 1960	780	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\carcasses\auriferous.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\carcasses\auriferous.dll
  2⤵
  PID:1960

memory/780-54-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp

Filesize
8KB

Download
memory/1960-56-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1960-57-0x0000000074880000-0x0000000074910000-memory.dmp

Filesize
576KB

Download
memory/1960-58-0x0000000074880000-0x0000000074910000-memory.dmp

Filesize
576KB

Download