a932ea0f18f0671d92c64df7e2001e2a8ca7a96d3fc9e9d71810c79b29ccb38d

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 23:07

Target

a932ea0f18f0671d92c64df7e2001e2a8ca7a96d3fc9e9d71810c79b29ccb38d.dll
Size

588KB
MD5

92243581d2086e8ae43b6af6c3dbff30
SHA1

4baa0a3c91388e825b8ba391254ce225caf262c8
SHA256

a932ea0f18f0671d92c64df7e2001e2a8ca7a96d3fc9e9d71810c79b29ccb38d
SHA512

84107f7948470e0d0adc81ec3bf456352d1941a76fa6886240b6a5f561ce9f89065ed1f2eb20bfc63318af04d6931c9a6e83e579e1438a893944dfda93e0bc39
SSDEEP

12288:dHztGB6l9ia4Lv68yoaaPu5vb+YF/zYwQm8:dJGwl9ia4Lv68yoaam5vb+u/zl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1904	900	regsvr32.exe	27
PID 900 wrote to memory of 1904	900	regsvr32.exe	27
PID 900 wrote to memory of 1904	900	regsvr32.exe	27
PID 900 wrote to memory of 1904	900	regsvr32.exe	27
PID 900 wrote to memory of 1904	900	regsvr32.exe	27
PID 900 wrote to memory of 1904	900	regsvr32.exe	27
PID 900 wrote to memory of 1904	900	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a932ea0f18f0671d92c64df7e2001e2a8ca7a96d3fc9e9d71810c79b29ccb38d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a932ea0f18f0671d92c64df7e2001e2a8ca7a96d3fc9e9d71810c79b29ccb38d.dll
  2⤵
  PID:1904

memory/900-54-0x000007FEFBB41000-0x000007FEFBB43000-memory.dmp

Filesize
8KB

Download
memory/1904-56-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download