3a1fcf6a50cafad00781b906a3417b68aa5abbdd7d1c6ced1a6feb9eefccfb37

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:18

Target

3a1fcf6a50cafad00781b906a3417b68aa5abbdd7d1c6ced1a6feb9eefccfb37.dll
Size

120KB
MD5

5693099804bf0151e7874778b910d9cd
SHA1

9b6ba7b2a1e3d8cd682b1e4a60aeb81a0ce4a72b
SHA256

3a1fcf6a50cafad00781b906a3417b68aa5abbdd7d1c6ced1a6feb9eefccfb37
SHA512

a0af14bd6f07d15916b8019fc34a09f2f5a9bda8e684f8b7753aad9357fad3587d26f9601615b4e34a6ce957cc74f0a9071aeda62b336dcfc352b8404361c0dd
SSDEEP

1536:OlqcQf8EVmtoAap73Q+jZsisiuxnf2j1DezyG:kw8Eyrap8YsifuxfY1iGG

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1664	1504	regsvr32.exe	28
PID 1504 wrote to memory of 1664	1504	regsvr32.exe	28
PID 1504 wrote to memory of 1664	1504	regsvr32.exe	28
PID 1504 wrote to memory of 1664	1504	regsvr32.exe	28
PID 1504 wrote to memory of 1664	1504	regsvr32.exe	28
PID 1504 wrote to memory of 1664	1504	regsvr32.exe	28
PID 1504 wrote to memory of 1664	1504	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3a1fcf6a50cafad00781b906a3417b68aa5abbdd7d1c6ced1a6feb9eefccfb37.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3a1fcf6a50cafad00781b906a3417b68aa5abbdd7d1c6ced1a6feb9eefccfb37.dll
  2⤵
  PID:1664

memory/1504-54-0x000007FEFBCE1000-0x000007FEFBCE3000-memory.dmp

Filesize
8KB

Download
memory/1664-56-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download