752633a44b7df0d15409df13bcff1c190040003ece85e0d182d48aeb7d21fc08

Analysis

max time kernel
57s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 22:26

Target

752633a44b7df0d15409df13bcff1c190040003ece85e0d182d48aeb7d21fc08.dll
Size

25KB
MD5

81eef17c31359ce157f41442abc64591
SHA1

ad018718baa90ca6bcfab9e3411f4e7186c47565
SHA256

752633a44b7df0d15409df13bcff1c190040003ece85e0d182d48aeb7d21fc08
SHA512

b7a737cf0bca1d73281e93962219d9dd1efe3fd2b616c042c3dbaea18e57c46ce071a65a60cc1a0af23c5c6f3694f7be711b65f7a99e825fabff21ba98730e02
SSDEEP

384:q+KZKRCI4TQ4nzC6LTQ4n3f/8YPVS7o4CaHY0:7FMK4zDQ43H8YdCojaH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 904	1140	regsvr32.exe	28
PID 1140 wrote to memory of 904	1140	regsvr32.exe	28
PID 1140 wrote to memory of 904	1140	regsvr32.exe	28
PID 1140 wrote to memory of 904	1140	regsvr32.exe	28
PID 1140 wrote to memory of 904	1140	regsvr32.exe	28
PID 1140 wrote to memory of 904	1140	regsvr32.exe	28
PID 1140 wrote to memory of 904	1140	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\752633a44b7df0d15409df13bcff1c190040003ece85e0d182d48aeb7d21fc08.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\752633a44b7df0d15409df13bcff1c190040003ece85e0d182d48aeb7d21fc08.dll
  2⤵
  PID:904

memory/904-56-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1140-54-0x000007FEFB731000-0x000007FEFB733000-memory.dmp

Filesize
8KB

Download