ecf7c440bd14f1b46defac9e79f0209507a50b396d0b6f8e72fd6b6618cb78b4

Analysis

max time kernel
20s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 18:31

Target

ecf7c440bd14f1b46defac9e79f0209507a50b396d0b6f8e72fd6b6618cb78b4.dll
Size

418KB
MD5

4321e47c08bb72774345c5e225ad2379
SHA1

9539e1f229c464c67b29adc72ada350378dec203
SHA256

ecf7c440bd14f1b46defac9e79f0209507a50b396d0b6f8e72fd6b6618cb78b4
SHA512

c48d72a198b93c93de7620a20abfe07eabbd354fd25f815ac1827222bb609a8dc032755f5d01a90d1a07aca63ab3c976a13405bc18d9661275703c85124a5a14
SSDEEP

6144:lR4gVFcQx4fvfWylnccoXotOU7BTjiNd:Q22fvfWyOco0P7By

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 836	1480	regsvr32.exe	27
PID 1480 wrote to memory of 836	1480	regsvr32.exe	27
PID 1480 wrote to memory of 836	1480	regsvr32.exe	27
PID 1480 wrote to memory of 836	1480	regsvr32.exe	27
PID 1480 wrote to memory of 836	1480	regsvr32.exe	27
PID 1480 wrote to memory of 836	1480	regsvr32.exe	27
PID 1480 wrote to memory of 836	1480	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ecf7c440bd14f1b46defac9e79f0209507a50b396d0b6f8e72fd6b6618cb78b4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ecf7c440bd14f1b46defac9e79f0209507a50b396d0b6f8e72fd6b6618cb78b4.dll
  2⤵
  PID:836

memory/836-56-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/1480-54-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmp

Filesize
8KB

Download