21f9a66ef042bde5d2dc2f9ca75e5e7090369f89da678feb72262ea7e5a57120

Analysis

max time kernel
27s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:03

Target

21f9a66ef042bde5d2dc2f9ca75e5e7090369f89da678feb72262ea7e5a57120.dll
Size

170KB
MD5

2ccf3cb208f18b56e9a52ba73df6df43
SHA1

3c8555c0fd682734027d844336fdb3feaf72061a
SHA256

21f9a66ef042bde5d2dc2f9ca75e5e7090369f89da678feb72262ea7e5a57120
SHA512

d8ec3a4a0fe903ac87f928b2468e995c48d0f110e0c8914cd776ba89d6aa99086a7ff315a86a14291778809e6f1e8265916738ffeba37102bd0be60770b411e9
SSDEEP

3072:eUXlFI6KSyss2qQwPyEKM3yCFWPusDBdR8ZdCzH/SxwsK1kN22B3szwk1:eMXI6byNqSx3yC8PVDBdRaCzH/Sxwn1D

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 980 wrote to memory of 1892	980	regsvr32.exe	regsvr32.exe
PID 980 wrote to memory of 1892	980	regsvr32.exe	regsvr32.exe
PID 980 wrote to memory of 1892	980	regsvr32.exe	regsvr32.exe
PID 980 wrote to memory of 1892	980	regsvr32.exe	regsvr32.exe
PID 980 wrote to memory of 1892	980	regsvr32.exe	regsvr32.exe
PID 980 wrote to memory of 1892	980	regsvr32.exe	regsvr32.exe
PID 980 wrote to memory of 1892	980	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\21f9a66ef042bde5d2dc2f9ca75e5e7090369f89da678feb72262ea7e5a57120.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\21f9a66ef042bde5d2dc2f9ca75e5e7090369f89da678feb72262ea7e5a57120.dll
2⤵
PID:1892

memory/980-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download
memory/1892-55-0x0000000000000000-mapping.dmp

Download
memory/1892-56-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download