35c9b2a38970832e3f2055bf3a781222f340316cda9858a2ec4270975505ff5b

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 20:18

Target

35c9b2a38970832e3f2055bf3a781222f340316cda9858a2ec4270975505ff5b.dll
Size

120KB
MD5

15deaf0c83c1044d84c6ed6c857eb6cd
SHA1

dc21a974554c243e048191da190f2e078ca181e4
SHA256

35c9b2a38970832e3f2055bf3a781222f340316cda9858a2ec4270975505ff5b
SHA512

6adff2948b8ab8f366a056fe548c3cce905c80cd557f8f04624b5736de866e1aad7363bbfaa317ac0b31baad75756c0760cb3478157cb8fd56adb268c8425d7c
SSDEEP

1536:ZhqqQFDf6MmbFmWImx6Ay15WnNQYEM6ss15D:ViDfUoDm4A5nNQ1v

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 856	620	regsvr32.exe	27
PID 620 wrote to memory of 856	620	regsvr32.exe	27
PID 620 wrote to memory of 856	620	regsvr32.exe	27
PID 620 wrote to memory of 856	620	regsvr32.exe	27
PID 620 wrote to memory of 856	620	regsvr32.exe	27
PID 620 wrote to memory of 856	620	regsvr32.exe	27
PID 620 wrote to memory of 856	620	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\35c9b2a38970832e3f2055bf3a781222f340316cda9858a2ec4270975505ff5b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\35c9b2a38970832e3f2055bf3a781222f340316cda9858a2ec4270975505ff5b.dll
  2⤵
  PID:856

memory/620-54-0x000007FEFC331000-0x000007FEFC333000-memory.dmp

Filesize
8KB

Download
memory/856-56-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download