341a087bc0f591b320d6c002e9eedd835310eaaf70c0151506c70c1120a237df

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 13:45

Target

carcasses/relocated.dll
Size

561KB
MD5

eb56bb9ae6f65fd905aed6a2eb6bf55d
SHA1

1185bc1a7f9fbe3838725f1d771865ef9fe076c9
SHA256

613fc48aa936c10c9e75ff6746e0405c1cdab68566d84cc46bb68e1bcb986aa0
SHA512

7ed825b1afdc822bd0aea1faa971144d12b8ccda756d4b326c59aac09247b5008846fad4c64a4d46d3633548874c346feb6a01968056a8ec6f79bd9678cbf2f4
SSDEEP

6144:ypIe6W8uc0KxlK9gpC1d88LKXLAOkuL9P5Qt6frqLwYzbn4NKToC2HD9qFmq:yptV8uc0KS9gpC1GI4v9PmgfKP1KJq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 988	1768	regsvr32.exe	27
PID 1768 wrote to memory of 988	1768	regsvr32.exe	27
PID 1768 wrote to memory of 988	1768	regsvr32.exe	27
PID 1768 wrote to memory of 988	1768	regsvr32.exe	27
PID 1768 wrote to memory of 988	1768	regsvr32.exe	27
PID 1768 wrote to memory of 988	1768	regsvr32.exe	27
PID 1768 wrote to memory of 988	1768	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\carcasses\relocated.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\carcasses\relocated.dll
  2⤵
  PID:988

memory/988-56-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/988-57-0x0000000074F70000-0x0000000075000000-memory.dmp

Filesize
576KB

Download
memory/988-58-0x0000000074F70000-0x0000000075000000-memory.dmp

Filesize
576KB

Download
memory/1768-54-0x000007FEFC591000-0x000007FEFC593000-memory.dmp

Filesize
8KB

Download