3d58d92d34cc3ada7e15a02816cd2388b10591618d2c29ed35e1786526265926

Analysis

max time kernel
4s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 01:10

Target

3d58d92d34cc3ada7e15a02816cd2388b10591618d2c29ed35e1786526265926.dll
Size

143KB
MD5

27578daec66f4cc4891ce4a029207300
SHA1

9c361704568c671949f41580845d21b2e67ea9db
SHA256

3d58d92d34cc3ada7e15a02816cd2388b10591618d2c29ed35e1786526265926
SHA512

e25f6db75cc05ea5f7a5a3c51c1bf325a68ecb9c47852ba717871653a22122606fc8f8cd0332d4acdce967f1fd04d44ab4b8c7e017f256bb688a89e8d6dff820
SSDEEP

3072:NMQehZRwDur+suLi/SjHY4gV8BcHem/hSfr57PmwnOinC:NMnZRwarqOSDY4gOBcHem/QfNPmwnOiC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 940	2028	regsvr32.exe	28
PID 2028 wrote to memory of 940	2028	regsvr32.exe	28
PID 2028 wrote to memory of 940	2028	regsvr32.exe	28
PID 2028 wrote to memory of 940	2028	regsvr32.exe	28
PID 2028 wrote to memory of 940	2028	regsvr32.exe	28
PID 2028 wrote to memory of 940	2028	regsvr32.exe	28
PID 2028 wrote to memory of 940	2028	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3d58d92d34cc3ada7e15a02816cd2388b10591618d2c29ed35e1786526265926.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3d58d92d34cc3ada7e15a02816cd2388b10591618d2c29ed35e1786526265926.dll
  2⤵
  PID:940

memory/940-56-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download
memory/2028-54-0x000007FEFB881000-0x000007FEFB883000-memory.dmp

Filesize
8KB

Download