198b75e68a2e2b73cad54be773b41bd9d0ac969aba0d7400fb900579ea601d01

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 22:42

Target

198b75e68a2e2b73cad54be773b41bd9d0ac969aba0d7400fb900579ea601d01.dll
Size

30KB
MD5

0ab375d32d0c2f2cffb9a838b63c3a3b
SHA1

84d444a73365bf1db25f03ea62d10646cd1e511b
SHA256

198b75e68a2e2b73cad54be773b41bd9d0ac969aba0d7400fb900579ea601d01
SHA512

ea0d5f19cfbc9e6543c6647d22ba4ec0078c98841dc1f4ed5a54282e2bebd25e2836717213fd91453c5028b710aea4807b0b5d62e8d013770bf8857c3a25674b
SSDEEP

768:VLM8JjlVmlQIHTRF8id6jYT4t6XjWdlPP:VLnjlVm/TAYEICd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 1356	852	regsvr32.exe	27
PID 852 wrote to memory of 1356	852	regsvr32.exe	27
PID 852 wrote to memory of 1356	852	regsvr32.exe	27
PID 852 wrote to memory of 1356	852	regsvr32.exe	27
PID 852 wrote to memory of 1356	852	regsvr32.exe	27
PID 852 wrote to memory of 1356	852	regsvr32.exe	27
PID 852 wrote to memory of 1356	852	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\198b75e68a2e2b73cad54be773b41bd9d0ac969aba0d7400fb900579ea601d01.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\198b75e68a2e2b73cad54be773b41bd9d0ac969aba0d7400fb900579ea601d01.dll
  2⤵
  PID:1356

memory/852-54-0x000007FEFB651000-0x000007FEFB653000-memory.dmp

Filesize
8KB

Download
memory/1356-56-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1356-57-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download