ccb159e2119afad2d0ba90cf0e573519250cce5c11bb4184db504d2b39146535

Analysis

max time kernel
26s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 04:02

Target

ccb159e2119afad2d0ba90cf0e573519250cce5c11bb4184db504d2b39146535.dll
Size

19KB
MD5

103baef5347e37c279ec4303861a2d22
SHA1

6059999e25eb6f894d258fda4ed3fd5ebb355509
SHA256

ccb159e2119afad2d0ba90cf0e573519250cce5c11bb4184db504d2b39146535
SHA512

c3a788192dace34598f1ad089a36b09d4fa51406d98e638631f7c302ab5628baf1c3e2e87f610762a854d161865ffb415e71dfdfa77120e9f272513449115766
SSDEEP

384:eWWTEcWePKORLzOIB5X5mFh0V4wKOZk+SaJgD/JSu11h:VaKORLzOIBF5yCq8ZkTaqD5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1372	1208	regsvr32.exe	28
PID 1208 wrote to memory of 1372	1208	regsvr32.exe	28
PID 1208 wrote to memory of 1372	1208	regsvr32.exe	28
PID 1208 wrote to memory of 1372	1208	regsvr32.exe	28
PID 1208 wrote to memory of 1372	1208	regsvr32.exe	28
PID 1208 wrote to memory of 1372	1208	regsvr32.exe	28
PID 1208 wrote to memory of 1372	1208	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ccb159e2119afad2d0ba90cf0e573519250cce5c11bb4184db504d2b39146535.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ccb159e2119afad2d0ba90cf0e573519250cce5c11bb4184db504d2b39146535.dll
  2⤵
  PID:1372

memory/1208-54-0x000007FEFC0D1000-0x000007FEFC0D3000-memory.dmp

Filesize
8KB

Download
memory/1372-55-0x0000000000000000-mapping.dmp

Download
memory/1372-56-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download