41aa687660f59461d32e9d933953ce3a886297150d05992204232366401972bb

Analysis

max time kernel
38s
max time network
29s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 16:45

Target

41aa687660f59461d32e9d933953ce3a886297150d05992204232366401972bb.dll
Size

128KB
MD5

3aaaf0a305395befa4f699499893a037
SHA1

aec81e84bc8754f5822827c94ceef18ea5c1a7d9
SHA256

41aa687660f59461d32e9d933953ce3a886297150d05992204232366401972bb
SHA512

f38e3d2949b00c630a1627dc2852ac5081f668cf5e40b9f37d1c36d149ad4e810cc5c7167dad7d58615e05792a16c43146b0503f3fd5a8c5cf382a3b86782547
SSDEEP

3072:QPYkaAYBFcLS85vrr8aDA2h152+rvVx9ducI5VgTIjjaY:QgVAYQLS85jt9rvVLdf0gMjjaY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2024 wrote to memory of 1980	2024	regsvr32.exe	regsvr32.exe
PID 2024 wrote to memory of 1980	2024	regsvr32.exe	regsvr32.exe
PID 2024 wrote to memory of 1980	2024	regsvr32.exe	regsvr32.exe
PID 2024 wrote to memory of 1980	2024	regsvr32.exe	regsvr32.exe
PID 2024 wrote to memory of 1980	2024	regsvr32.exe	regsvr32.exe
PID 2024 wrote to memory of 1980	2024	regsvr32.exe	regsvr32.exe
PID 2024 wrote to memory of 1980	2024	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\41aa687660f59461d32e9d933953ce3a886297150d05992204232366401972bb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\41aa687660f59461d32e9d933953ce3a886297150d05992204232366401972bb.dll
  2⤵
  PID:1980

memory/1980-55-0x0000000000000000-mapping.dmp

Download
memory/1980-56-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/2024-54-0x000007FEFC451000-0x000007FEFC453000-memory.dmp

Filesize
8KB

Download