54b63cb73dc0d0b77ca6fdb0d2e4616a5f85b668623143b2f6dd820f8b5f922c

Analysis

max time kernel
35s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 05:41

Target

54b63cb73dc0d0b77ca6fdb0d2e4616a5f85b668623143b2f6dd820f8b5f922c.dll
Size

296KB
MD5

5a459cdf5478429e15c266e53a954ec7
SHA1

97e7fe1ea0464366580810cd28bf43392a5a186b
SHA256

54b63cb73dc0d0b77ca6fdb0d2e4616a5f85b668623143b2f6dd820f8b5f922c
SHA512

7436b8ee729553c98b3ab7b121b9e727de358e35893a2c1fd11ec60402f401c438c1528766433ed5f885c7103949cd9db0a18859c8b080bde71113deec5172e5
SSDEEP

3072:Sf5AsrfhqP3dJwV7tts2ltThBJf5ywd8rTmmL+35O4As2C4aA:SC2fw/d63ts2NxyE8fmuy5yu4a

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1736	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1736	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1736	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1736	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1736	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1736	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1736	1636	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\54b63cb73dc0d0b77ca6fdb0d2e4616a5f85b668623143b2f6dd820f8b5f922c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\54b63cb73dc0d0b77ca6fdb0d2e4616a5f85b668623143b2f6dd820f8b5f922c.dll
  2⤵
  PID:1736

memory/1636-54-0x000007FEFC311000-0x000007FEFC313000-memory.dmp

Filesize
8KB

Download
memory/1736-56-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download