a3f8788052cf05228d9d00679d025e073a0e19fb323ed58bb37d17b888910308

Analysis

max time kernel
11s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:42

Target

a3f8788052cf05228d9d00679d025e073a0e19fb323ed58bb37d17b888910308.dll
Size

256KB
MD5

52874caf75be9fde31dcec26e1acee35
SHA1

2b00463412788a73e19b9a11dfd9d5e7cf5be528
SHA256

a3f8788052cf05228d9d00679d025e073a0e19fb323ed58bb37d17b888910308
SHA512

93188bd9c1263bb4f9bf300f224bdf1645d14df7c493de98040b99bc2c32bbc40a1a5bc0af0a101791b7e43e53f7f740c42f164a950ac2252e0c524e6f916778
SSDEEP

6144:C2T59Z4/dJvy/Toc6fPG1DIblKrr/OGGfPg:fZIpy/TofTMWGc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1984 wrote to memory of 2008	1984	regsvr32.exe	regsvr32.exe
PID 1984 wrote to memory of 2008	1984	regsvr32.exe	regsvr32.exe
PID 1984 wrote to memory of 2008	1984	regsvr32.exe	regsvr32.exe
PID 1984 wrote to memory of 2008	1984	regsvr32.exe	regsvr32.exe
PID 1984 wrote to memory of 2008	1984	regsvr32.exe	regsvr32.exe
PID 1984 wrote to memory of 2008	1984	regsvr32.exe	regsvr32.exe
PID 1984 wrote to memory of 2008	1984	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a3f8788052cf05228d9d00679d025e073a0e19fb323ed58bb37d17b888910308.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\a3f8788052cf05228d9d00679d025e073a0e19fb323ed58bb37d17b888910308.dll
2⤵
PID:2008

memory/1984-54-0x000007FEFC201000-0x000007FEFC203000-memory.dmp

Filesize
8KB

Download
memory/2008-55-0x0000000000000000-mapping.dmp

Download
memory/2008-56-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download