f7f43371b7648e580596ed61114a33ded259de6576f2eea47ef0b7b252bf0b83

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:23

Target

f7f43371b7648e580596ed61114a33ded259de6576f2eea47ef0b7b252bf0b83.dll
Size

232KB
MD5

0c7daa6b07a33e5bad3ac2016251b829
SHA1

f73175d94698475ad03b0e50a7fa63924242b232
SHA256

f7f43371b7648e580596ed61114a33ded259de6576f2eea47ef0b7b252bf0b83
SHA512

963567b4623727e59b1f9654ad859489d1b050d759111e8db8dcc0b5fe9d1473b303b7f2fd2c0d1667fafc0d0579570b33ff37b74bbbfd16f1ca3be4741daad5
SSDEEP

3072:kvJrsIwI+JiohyzFsTMncTlMAW9K3X6PqS+Sy/0nwEUl8:WxwKxTnxvK3qPd+n/0cu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1528 wrote to memory of 1028	1528	regsvr32.exe	regsvr32.exe
PID 1528 wrote to memory of 1028	1528	regsvr32.exe	regsvr32.exe
PID 1528 wrote to memory of 1028	1528	regsvr32.exe	regsvr32.exe
PID 1528 wrote to memory of 1028	1528	regsvr32.exe	regsvr32.exe
PID 1528 wrote to memory of 1028	1528	regsvr32.exe	regsvr32.exe
PID 1528 wrote to memory of 1028	1528	regsvr32.exe	regsvr32.exe
PID 1528 wrote to memory of 1028	1528	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f7f43371b7648e580596ed61114a33ded259de6576f2eea47ef0b7b252bf0b83.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\f7f43371b7648e580596ed61114a33ded259de6576f2eea47ef0b7b252bf0b83.dll
2⤵
PID:1028

memory/1028-55-0x0000000000000000-mapping.dmp

Download
memory/1028-56-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/1528-54-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp

Filesize
8KB

Download