3fe110bded2b4bf2e8f9724a24aa83161b495d2ba9f659613be8dc4de4fe3f32

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 21:19

Target

3fe110bded2b4bf2e8f9724a24aa83161b495d2ba9f659613be8dc4de4fe3f32.dll
Size

332KB
MD5

035da6591abd2e9c5102440d9157d570
SHA1

40a8297f974121978e525481258d456e22ea878c
SHA256

3fe110bded2b4bf2e8f9724a24aa83161b495d2ba9f659613be8dc4de4fe3f32
SHA512

ab1d94804de128d943bb6dce3da79f59eb3b96252fa67c73102f3e1784c0a41961d41facf9efd8d0eb16bdb19c51c05e1ec0941dfd2ccbfa90dd752bcd8f1dd7
SSDEEP

6144:hqpaISLUCNlYIWXMPWEIDYE7yHzJyrMzDX+ir0wJTJonA3UEOktvA:hqpaISLUCNlYIW8PWEIDbyHzRDDYwBJw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2016	1896	regsvr32.exe	27
PID 1896 wrote to memory of 2016	1896	regsvr32.exe	27
PID 1896 wrote to memory of 2016	1896	regsvr32.exe	27
PID 1896 wrote to memory of 2016	1896	regsvr32.exe	27
PID 1896 wrote to memory of 2016	1896	regsvr32.exe	27
PID 1896 wrote to memory of 2016	1896	regsvr32.exe	27
PID 1896 wrote to memory of 2016	1896	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3fe110bded2b4bf2e8f9724a24aa83161b495d2ba9f659613be8dc4de4fe3f32.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3fe110bded2b4bf2e8f9724a24aa83161b495d2ba9f659613be8dc4de4fe3f32.dll
  2⤵
  PID:2016

memory/1896-54-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download