bb98d0c97704160b15ab50a1046e2f11e3765ffbbf68049f36c90b67f82e7719

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:23

Target

bb98d0c97704160b15ab50a1046e2f11e3765ffbbf68049f36c90b67f82e7719.dll
Size

196KB
MD5

31a18c8078af716ec4ca889890eceb7d
SHA1

93337a9e130684f55240651be5869e5fd99ba17f
SHA256

bb98d0c97704160b15ab50a1046e2f11e3765ffbbf68049f36c90b67f82e7719
SHA512

456f8267ca097f6306e0289b313383c9d0976073b53d47714fe766d983c369e68e080a862487ca0a65d574752fdf757b3267457b877eeaec477815d5e3ba5ec9
SSDEEP

3072:/mMPtnODbUdIMn5EDzX1lH70V/5VhKzT9sVAlNCOfn9eEFRbYnMU:OMPYQ52XH70V/5VwLNTnYn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1340 wrote to memory of 1768	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1768	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1768	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1768	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1768	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1768	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 1768	1340	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bb98d0c97704160b15ab50a1046e2f11e3765ffbbf68049f36c90b67f82e7719.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\bb98d0c97704160b15ab50a1046e2f11e3765ffbbf68049f36c90b67f82e7719.dll
2⤵
PID:1768

memory/1340-54-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download
memory/1768-55-0x0000000000000000-mapping.dmp

Download
memory/1768-56-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download