7ac0c34a7d13f0a69836c6cbbc26299982f62f55e43a46643c812063651edb2a

Analysis

max time kernel
31s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 03:26

Target

7ac0c34a7d13f0a69836c6cbbc26299982f62f55e43a46643c812063651edb2a.dll
Size

422KB
MD5

71485b6e734c080a21bf1df43f3c4cab
SHA1

42f09370247aa0dceed4f1bae4c7c39c86eab1f8
SHA256

7ac0c34a7d13f0a69836c6cbbc26299982f62f55e43a46643c812063651edb2a
SHA512

4c07a0d16f38abe9d32a570cf2aaca00ebe94d6193ca916b89b1ba55f8e28ae46a16c4fb34866f068dff4e8e089f94ee0c781f84db7c4d92ac2022190db92787
SSDEEP

12288:dZcfqnQsAqoCq3RH3M2W+2qQcbcMFumVTffPTUaiS:dgZC0R8ErFzfZiS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1052	2036	regsvr32.exe	26
PID 2036 wrote to memory of 1052	2036	regsvr32.exe	26
PID 2036 wrote to memory of 1052	2036	regsvr32.exe	26
PID 2036 wrote to memory of 1052	2036	regsvr32.exe	26
PID 2036 wrote to memory of 1052	2036	regsvr32.exe	26
PID 2036 wrote to memory of 1052	2036	regsvr32.exe	26
PID 2036 wrote to memory of 1052	2036	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7ac0c34a7d13f0a69836c6cbbc26299982f62f55e43a46643c812063651edb2a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7ac0c34a7d13f0a69836c6cbbc26299982f62f55e43a46643c812063651edb2a.dll
  2⤵
  PID:1052

memory/1052-55-0x0000000000000000-mapping.dmp

Download
memory/1052-56-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/2036-54-0x000007FEFBD11000-0x000007FEFBD13000-memory.dmp

Filesize
8KB

Download