b35bcdfc2d8b81077ea1ae616c0357b07393dabefaced6f65e74f0602748bb00

Analysis

max time kernel
4s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 22:11

Target

b35bcdfc2d8b81077ea1ae616c0357b07393dabefaced6f65e74f0602748bb00.dll
Size

128KB
MD5

43139280b0cacb7288973ccb4945a284
SHA1

7c3429fa1825265e7ddc1497c318e8632899a65e
SHA256

b35bcdfc2d8b81077ea1ae616c0357b07393dabefaced6f65e74f0602748bb00
SHA512

dfaba071a643d457b5e239a799030c30e3ccfa5809410306d1c5673116b38ef138225f3288cbd99cb1c3d92051cdf18a614c204c59aaed9f3990df7f9f557076
SSDEEP

1536:FkUgJ+DLTC2tOmXbJVaK3R0XMJ33iU5hVXl7NeLZ61due6moMNNlltdgHXTzHrz/:2aTOubqoNNfoZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 2044	1116	regsvr32.exe	28
PID 1116 wrote to memory of 2044	1116	regsvr32.exe	28
PID 1116 wrote to memory of 2044	1116	regsvr32.exe	28
PID 1116 wrote to memory of 2044	1116	regsvr32.exe	28
PID 1116 wrote to memory of 2044	1116	regsvr32.exe	28
PID 1116 wrote to memory of 2044	1116	regsvr32.exe	28
PID 1116 wrote to memory of 2044	1116	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b35bcdfc2d8b81077ea1ae616c0357b07393dabefaced6f65e74f0602748bb00.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b35bcdfc2d8b81077ea1ae616c0357b07393dabefaced6f65e74f0602748bb00.dll
  2⤵
  PID:2044

memory/1116-54-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Filesize
8KB

Download
memory/2044-56-0x0000000076221000-0x0000000076223000-memory.dmp

Filesize
8KB

Download