922addae4cba0be3fc3df6542613a7c2e3c8f645c02360e0d6168e31a0becd76

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 07:03

Target

922addae4cba0be3fc3df6542613a7c2e3c8f645c02360e0d6168e31a0becd76.dll
Size

19KB
MD5

76cc019de3d6585dcffed113d4504df8
SHA1

6c067ba93de7abc0f988cd1788d11f87a0748f44
SHA256

922addae4cba0be3fc3df6542613a7c2e3c8f645c02360e0d6168e31a0becd76
SHA512

d6010160374974994bbbbc041f164739610e9ae216c18662bf26f8d6d38ab0a50cad35b4b8b6e90f2d71f721e985a7505908ef508d64d3c52b09e332c863a2ed
SSDEEP

384:8TKir1i/8WaBn6igjVJGBoe4p2lQb5fx69HOZFCV4W6:OKig//CWJGBxXebn69ujbW6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 1888	992	regsvr32.exe	27
PID 992 wrote to memory of 1888	992	regsvr32.exe	27
PID 992 wrote to memory of 1888	992	regsvr32.exe	27
PID 992 wrote to memory of 1888	992	regsvr32.exe	27
PID 992 wrote to memory of 1888	992	regsvr32.exe	27
PID 992 wrote to memory of 1888	992	regsvr32.exe	27
PID 992 wrote to memory of 1888	992	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\922addae4cba0be3fc3df6542613a7c2e3c8f645c02360e0d6168e31a0becd76.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\922addae4cba0be3fc3df6542613a7c2e3c8f645c02360e0d6168e31a0becd76.dll
  2⤵
  PID:1888

memory/992-54-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Filesize
8KB

Download
memory/1888-56-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download