faede3f2b4ece070767de2b111183683c1d4ecf2cf598b78335ce92f103f8259

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 05:13

Target

faede3f2b4ece070767de2b111183683c1d4ecf2cf598b78335ce92f103f8259.dll
Size

19KB
MD5

0a5f852d12710deedf7535ebd0afca70
SHA1

5b1db05004cbac69ee8b6577b3973200275dba07
SHA256

faede3f2b4ece070767de2b111183683c1d4ecf2cf598b78335ce92f103f8259
SHA512

3f7dcebd9f1244f5eb6b6fff2571a6f1e4ac18a439888275985e9f68fc8c34503ac818305ec121c94896bb49ca3a48776305d5d18f2019343312203ef0d7ebd1
SSDEEP

384:cWWTEcWjd55SolrDwjWU/mCNn49TkRBLoObb66Ij9Tfn7:3Zros4WUdy9TOLeTz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 988	2024	regsvr32.exe	27
PID 2024 wrote to memory of 988	2024	regsvr32.exe	27
PID 2024 wrote to memory of 988	2024	regsvr32.exe	27
PID 2024 wrote to memory of 988	2024	regsvr32.exe	27
PID 2024 wrote to memory of 988	2024	regsvr32.exe	27
PID 2024 wrote to memory of 988	2024	regsvr32.exe	27
PID 2024 wrote to memory of 988	2024	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\faede3f2b4ece070767de2b111183683c1d4ecf2cf598b78335ce92f103f8259.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\faede3f2b4ece070767de2b111183683c1d4ecf2cf598b78335ce92f103f8259.dll
  2⤵
  PID:988

memory/988-56-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/2024-54-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

Filesize
8KB

Download