dff923ab9eeaf7e1d9a0ff4d13c8478d164ba860fa8ed25136fecb3ba02db34d

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 00:00

Target

dff923ab9eeaf7e1d9a0ff4d13c8478d164ba860fa8ed25136fecb3ba02db34d.dll
Size

128KB
MD5

0ac245dafa391b498c77c31fcb5acfcd
SHA1

248beeb4b3442aa9106df2507f8c5e1e7676f1f2
SHA256

dff923ab9eeaf7e1d9a0ff4d13c8478d164ba860fa8ed25136fecb3ba02db34d
SHA512

fcb536742b8a73fdd597093a1ea1a74401fd69cba87f0165ee7f7f6b0196f22349f6c2b2078aa8eaab946902e89b0d3a2785413a6f6dd0c2e97272b1c7d924b6
SSDEEP

1536:LUgJ+bAg2rWyvmULwsQqdnITBNQIZnCLzs3A6:LRrWyv7wc8iItCLzs3H

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27
PID 1128 wrote to memory of 1112	1128	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dff923ab9eeaf7e1d9a0ff4d13c8478d164ba860fa8ed25136fecb3ba02db34d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dff923ab9eeaf7e1d9a0ff4d13c8478d164ba860fa8ed25136fecb3ba02db34d.dll
  2⤵
  PID:1112

memory/1112-55-0x0000000000000000-mapping.dmp

Download
memory/1112-56-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1128-54-0x000007FEFC591000-0x000007FEFC593000-memory.dmp

Filesize
8KB

Download