f70d3601fb456a18ed7e7ed599d10783447016da78234f5dca61b8bd3a084a15

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/11/2022, 18:37

Target

_/___/_/___/______/_____/__/ClassicExplorer32.dll
Size

112KB
MD5

6d6a0ca7c7343eedfffeb697229a4929
SHA1

b8bc6878030e51c6726b8536473e396e75969462
SHA256

8e27900949a087349488d82e7434937bd253d31749041bb0233000a7339fc3e1
SHA512

40e9f5839637096de31b7a342fd8ef4c111725b65202ca8a5ab0d61f562d5c36dac2b347b82bb242cf56d8453b7c077043308652fd8e2e829370e6874f6793c4
SSDEEP

3072:9xcDum8qFNKZ602pFSjhLZiGcxmpJ8yLRuMRN55OyL6mg:XrmbpFQ0Gcx0JnPMi6mg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1748	1492	regsvr32.exe	27
PID 1492 wrote to memory of 1748	1492	regsvr32.exe	27
PID 1492 wrote to memory of 1748	1492	regsvr32.exe	27
PID 1492 wrote to memory of 1748	1492	regsvr32.exe	27
PID 1492 wrote to memory of 1748	1492	regsvr32.exe	27
PID 1492 wrote to memory of 1748	1492	regsvr32.exe	27
PID 1492 wrote to memory of 1748	1492	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\_\___\_\___\______\_____\__\ClassicExplorer32.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\_\___\_\___\______\_____\__\ClassicExplorer32.dll
  2⤵
  PID:1748

memory/1492-54-0x000007FEFC5A1000-0x000007FEFC5A3000-memory.dmp

Filesize
8KB

Download
memory/1748-56-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download