d8d97950e70533fdf1f14f002b7b29b37ec57aa9bc552cf5c25f498edf48b9d6

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 10:18

Target

d8d97950e70533fdf1f14f002b7b29b37ec57aa9bc552cf5c25f498edf48b9d6.dll
Size

1.2MB
MD5

317b1ea7ecbd6ea6448538f8cefae520
SHA1

57080e045d44aebcdd74b492cf5022c70635387d
SHA256

d8d97950e70533fdf1f14f002b7b29b37ec57aa9bc552cf5c25f498edf48b9d6
SHA512

f1cc36d8190405648e157490e3ae75c58bc8daf9414cb35272e385a577e8de5fc534cc569b27d4d295a027b964f295466967cf68112832fd49ac4c1b02edb5c8
SSDEEP

24576:N2Ud3zDBThoKwSURh3VXb1RRvKTadSpHs5H0NhVrn:IUd3bnw3FxRRiTUsM5H2hZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1508	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1508	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1508	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1508	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1508	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1508	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1508	1092	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d8d97950e70533fdf1f14f002b7b29b37ec57aa9bc552cf5c25f498edf48b9d6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d8d97950e70533fdf1f14f002b7b29b37ec57aa9bc552cf5c25f498edf48b9d6.dll
  2⤵
  PID:1508

memory/1092-54-0x000007FEFB761000-0x000007FEFB763000-memory.dmp

Filesize
8KB

Download
memory/1508-56-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download