904b315e423767aa63456120fe84b5ab444e2c7ff907989581ae18dd36d741be

Analysis

max time kernel
40s
max time network
113s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:05

Target

904b315e423767aa63456120fe84b5ab444e2c7ff907989581ae18dd36d741be.dll
Size

188KB
MD5

525781ec579365419c898f5fb71b11f2
SHA1

5edf4726787fbda378a798144e3d30aadc6a185f
SHA256

904b315e423767aa63456120fe84b5ab444e2c7ff907989581ae18dd36d741be
SHA512

c133434085ee181618a772b02b510d2425fe52139f6f7e0ef1ea45c7fea025257486b997928e0daeb3ff99b7640bc17df7cb65f11b1e9574543510ed6d9fcc41
SSDEEP

3072:eLce4kPUgSitPGqLUNp0ztjn7/ySJz/B6y7Iu+eTruvk6K00osk/RB0BKsohM:zk5jEp0Z/ySn6y7IteTCc6K9Jk/RBMK9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1428 wrote to memory of 880	1428	regsvr32.exe	regsvr32.exe
PID 1428 wrote to memory of 880	1428	regsvr32.exe	regsvr32.exe
PID 1428 wrote to memory of 880	1428	regsvr32.exe	regsvr32.exe
PID 1428 wrote to memory of 880	1428	regsvr32.exe	regsvr32.exe
PID 1428 wrote to memory of 880	1428	regsvr32.exe	regsvr32.exe
PID 1428 wrote to memory of 880	1428	regsvr32.exe	regsvr32.exe
PID 1428 wrote to memory of 880	1428	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\904b315e423767aa63456120fe84b5ab444e2c7ff907989581ae18dd36d741be.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\904b315e423767aa63456120fe84b5ab444e2c7ff907989581ae18dd36d741be.dll
2⤵
PID:880

memory/880-55-0x0000000000000000-mapping.dmp

Download
memory/880-56-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1428-54-0x000007FEFB821000-0x000007FEFB823000-memory.dmp

Filesize
8KB

Download