99126f049f918508672d8905b87f6629201b72eec9578166ac973f39f1becc25

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 02:41

Target

99126f049f918508672d8905b87f6629201b72eec9578166ac973f39f1becc25.dll
Size

436KB
MD5

4cbb1126636d1d61bb1d884964c3c400
SHA1

0b9d69597304edd7d6abe4ff878b61ea17f3ee5d
SHA256

99126f049f918508672d8905b87f6629201b72eec9578166ac973f39f1becc25
SHA512

a30676e4d457a1732fd723d8a1002f892331da4420d2a27f0e0506f39e565a6eadc5e95c2a90003d2051266cd94473ad9e9584c4f1a0497aa9ec9a23afac3cfc
SSDEEP

6144:YG4cvRprRSvftI3gwK1lBrOldXWEA7d1D1LL2JqnAA31ZiWG3A3JMr+mtt4/3Lnr:YWeI3gwU5d1B1nHZdH3JMaLHb3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 948	2028	regsvr32.exe	27
PID 2028 wrote to memory of 948	2028	regsvr32.exe	27
PID 2028 wrote to memory of 948	2028	regsvr32.exe	27
PID 2028 wrote to memory of 948	2028	regsvr32.exe	27
PID 2028 wrote to memory of 948	2028	regsvr32.exe	27
PID 2028 wrote to memory of 948	2028	regsvr32.exe	27
PID 2028 wrote to memory of 948	2028	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\99126f049f918508672d8905b87f6629201b72eec9578166ac973f39f1becc25.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\99126f049f918508672d8905b87f6629201b72eec9578166ac973f39f1becc25.dll
  2⤵
  PID:948

memory/948-55-0x0000000000000000-mapping.dmp

Download
memory/948-56-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/2028-54-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download