b17382097026eb2f4340f075b18c1435f85284b74dff9e6f4eb123fa94b2050f

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 10:31

Target

b17382097026eb2f4340f075b18c1435f85284b74dff9e6f4eb123fa94b2050f.dll
Size

256KB
MD5

400262d0316eb5d60684890406118c30
SHA1

a7f34dd0aa57e1fc95feab9b961eeb054d2d4236
SHA256

b17382097026eb2f4340f075b18c1435f85284b74dff9e6f4eb123fa94b2050f
SHA512

967ecf9e966ef3ffe8941431725da37686f314622daa0d3027800dd45483a28251d871439e4c5904e3c13971b0a9a0d5cee7a87c1112732e888ed8340714d1aa
SSDEEP

6144:TubZtB6ioIiZT3nJx8mpgNzD4baK7n+cN:Q6ioIiZTZxyD4OKLr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2012	1652	regsvr32.exe	28
PID 1652 wrote to memory of 2012	1652	regsvr32.exe	28
PID 1652 wrote to memory of 2012	1652	regsvr32.exe	28
PID 1652 wrote to memory of 2012	1652	regsvr32.exe	28
PID 1652 wrote to memory of 2012	1652	regsvr32.exe	28
PID 1652 wrote to memory of 2012	1652	regsvr32.exe	28
PID 1652 wrote to memory of 2012	1652	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b17382097026eb2f4340f075b18c1435f85284b74dff9e6f4eb123fa94b2050f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b17382097026eb2f4340f075b18c1435f85284b74dff9e6f4eb123fa94b2050f.dll
  2⤵
  PID:2012

memory/1652-54-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Filesize
8KB

Download
memory/2012-56-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download