4b1203ca9ee5f49218dd214913ea039ddf7c25a83eb0f830148d3f2a0b27bd8d

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:18

Target

4b1203ca9ee5f49218dd214913ea039ddf7c25a83eb0f830148d3f2a0b27bd8d.dll
Size

75KB
MD5

5f31e4ad121db2276f493eb6e35d6cd0
SHA1

2e32081f53f37fe94142d16b7499a928a7b096c5
SHA256

4b1203ca9ee5f49218dd214913ea039ddf7c25a83eb0f830148d3f2a0b27bd8d
SHA512

a85408ff8f07deb1d06c957c376ba33be6e1274eda99c1eb33b0102083838f4416f31d40acf32d93dedea8f98ef77c389c23b08334f96d66d16d89fb5433ab15
SSDEEP

1536:eKEUyvvuTXZFmA/CTUBxbClQUlwdk4RE3krgATps:7WvuTXtZGlQRdk4RBrgd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2032 wrote to memory of 1104	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1104	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1104	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1104	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1104	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1104	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1104	2032	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4b1203ca9ee5f49218dd214913ea039ddf7c25a83eb0f830148d3f2a0b27bd8d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\4b1203ca9ee5f49218dd214913ea039ddf7c25a83eb0f830148d3f2a0b27bd8d.dll
2⤵
PID:1104

memory/1104-55-0x0000000000000000-mapping.dmp

Download
memory/1104-56-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2032-54-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

Filesize
8KB

Download