e4cb7971c9b9d281213910b404a294af19711da54139ed627d415c68f9196c8d

Analysis

max time kernel
38s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 08:49

Target

e4cb7971c9b9d281213910b404a294af19711da54139ed627d415c68f9196c8d.dll
Size

86KB
MD5

92cb5a7e81e520d1bb0b7410d8a21a8a
SHA1

d0121496af070c994a98ceb4bc82aa246758146a
SHA256

e4cb7971c9b9d281213910b404a294af19711da54139ed627d415c68f9196c8d
SHA512

8ccde7f1d23915a8e30a48535648a26a3985459f0a2f7f4828020842b8e375f0d226c57c7e81f270baf2517e6ba35f7ce34c871739ad9dbfdf822a9a325f428c
SSDEEP

1536:U4yyoTcP2Hh8/RU3rA1vpHGqJrwHwzFNIQ0NOSE8Hhd6mcbcccPfVm:Uca6S0vR7BmA/4/4ofk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 2004	544	regsvr32.exe	26
PID 544 wrote to memory of 2004	544	regsvr32.exe	26
PID 544 wrote to memory of 2004	544	regsvr32.exe	26
PID 544 wrote to memory of 2004	544	regsvr32.exe	26
PID 544 wrote to memory of 2004	544	regsvr32.exe	26
PID 544 wrote to memory of 2004	544	regsvr32.exe	26
PID 544 wrote to memory of 2004	544	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e4cb7971c9b9d281213910b404a294af19711da54139ed627d415c68f9196c8d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e4cb7971c9b9d281213910b404a294af19711da54139ed627d415c68f9196c8d.dll
  2⤵
  PID:2004

memory/544-54-0x000007FEFBB21000-0x000007FEFBB23000-memory.dmp

Filesize
8KB

Download
memory/2004-56-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download