ef58bb6f84cc0c7cd368bb920bdd3ed514c07c1f987150ba8fb4ffaf16c8b18a

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 12:03

Target

ef58bb6f84cc0c7cd368bb920bdd3ed514c07c1f987150ba8fb4ffaf16c8b18a.dll
Size

648KB
MD5

09d92bbc95fae420c1e1d25e9af3d253
SHA1

73d25e8eae49e5277a72fa997e3c31efedd3cfd8
SHA256

ef58bb6f84cc0c7cd368bb920bdd3ed514c07c1f987150ba8fb4ffaf16c8b18a
SHA512

b2135597b94ee28f7990d429b5a5278bf982c7e5b271684b5082dbee37cd3b15eb00e7a1af759980496809ac13f873af66a345e834f127fb04131c41926d2f2e
SSDEEP

12288:TpsX22vwS+ZXlJSuT0Sc4FS+fXiAjKLApl+Yki:Th2Ibh7T0wLfEBYki

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 960	1492	regsvr32.exe	28
PID 1492 wrote to memory of 960	1492	regsvr32.exe	28
PID 1492 wrote to memory of 960	1492	regsvr32.exe	28
PID 1492 wrote to memory of 960	1492	regsvr32.exe	28
PID 1492 wrote to memory of 960	1492	regsvr32.exe	28
PID 1492 wrote to memory of 960	1492	regsvr32.exe	28
PID 1492 wrote to memory of 960	1492	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ef58bb6f84cc0c7cd368bb920bdd3ed514c07c1f987150ba8fb4ffaf16c8b18a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ef58bb6f84cc0c7cd368bb920bdd3ed514c07c1f987150ba8fb4ffaf16c8b18a.dll
  2⤵
  PID:960

memory/960-56-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1492-54-0x000007FEFC371000-0x000007FEFC373000-memory.dmp

Filesize
8KB

Download