212749c78641c3444f2d6f38345633e9f72d669f4d06117ac49b45e9ebc04656

Analysis

max time kernel
11s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 12:36

Target

212749c78641c3444f2d6f38345633e9f72d669f4d06117ac49b45e9ebc04656.dll
Size

34KB
MD5

7602b54979b949d4c4ae23e83d01f70c
SHA1

f163aee8324f1adab0e4a0d5c2b2ca992069a89d
SHA256

212749c78641c3444f2d6f38345633e9f72d669f4d06117ac49b45e9ebc04656
SHA512

0ff9aa8767a9b7d48eaa182ccff16212af9fc27c63f71e599fee786f21dc1db68af137bf131324f6833973cb530430cc064d52f378a4034f3648d550737ee455
SSDEEP

768:u6DWYvhR0ZuNeHO9S1f9ig7DbXcmp+qJ2:uCpNj9SdXcW/2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1372	1640	regsvr32.exe	27
PID 1640 wrote to memory of 1372	1640	regsvr32.exe	27
PID 1640 wrote to memory of 1372	1640	regsvr32.exe	27
PID 1640 wrote to memory of 1372	1640	regsvr32.exe	27
PID 1640 wrote to memory of 1372	1640	regsvr32.exe	27
PID 1640 wrote to memory of 1372	1640	regsvr32.exe	27
PID 1640 wrote to memory of 1372	1640	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\212749c78641c3444f2d6f38345633e9f72d669f4d06117ac49b45e9ebc04656.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\212749c78641c3444f2d6f38345633e9f72d669f4d06117ac49b45e9ebc04656.dll
  2⤵
  PID:1372

memory/1372-56-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1640-54-0x000007FEFB821000-0x000007FEFB823000-memory.dmp

Filesize
8KB

Download