822de860acb794f17ab47e3003345eaff3eac743a6b601d14662d0d01270c1c7

Analysis

max time kernel
29s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:55

Target

822de860acb794f17ab47e3003345eaff3eac743a6b601d14662d0d01270c1c7.dll
Size

75KB
MD5

368c56806852c50c8f91093600a8a89a
SHA1

43f98d0375b48e1d48195da356d090647daddf75
SHA256

822de860acb794f17ab47e3003345eaff3eac743a6b601d14662d0d01270c1c7
SHA512

44268c966c6816570b5d77e2accff326cd31fc31c5411f37686dbadf90c79a9253b2c8f18a6ba8fde5e6c69c3b83144253ffacaf39e548c79f34cf2266af1bb0
SSDEEP

1536:oelpK6Bp3ctQHCMQM+YRpZhIR5nsl2hoRC1D39YbvWzD:oWK2pmQQMrpOssR3nD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1420 wrote to memory of 1996	1420	regsvr32.exe	regsvr32.exe
PID 1420 wrote to memory of 1996	1420	regsvr32.exe	regsvr32.exe
PID 1420 wrote to memory of 1996	1420	regsvr32.exe	regsvr32.exe
PID 1420 wrote to memory of 1996	1420	regsvr32.exe	regsvr32.exe
PID 1420 wrote to memory of 1996	1420	regsvr32.exe	regsvr32.exe
PID 1420 wrote to memory of 1996	1420	regsvr32.exe	regsvr32.exe
PID 1420 wrote to memory of 1996	1420	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\822de860acb794f17ab47e3003345eaff3eac743a6b601d14662d0d01270c1c7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\822de860acb794f17ab47e3003345eaff3eac743a6b601d14662d0d01270c1c7.dll
2⤵
PID:1996

memory/1420-54-0x000007FEFC451000-0x000007FEFC453000-memory.dmp

Filesize
8KB

Download
memory/1996-55-0x0000000000000000-mapping.dmp

Download
memory/1996-56-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download