04d1ffad25e9541cf1c0d2a054aba4b2cd2ca03c764cbf62bf8900cb92a38221

Analysis

max time kernel
14s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 07:12

Target

TheWorldPortable/Application/6.2.0.128/plugins/npactivex.dll
Size

31KB
MD5

873ad09e764c0720b4102822ad6f0a14
SHA1

1574ee9a4e51b203d7d6390cb3a01561b8a971cb
SHA256

58dd10ebe45ff753f1847216dce3743e1ef109030ecfa2555157b9a09c56fda1
SHA512

e80dadf34aba2cd769fa3ad4c993ec988a747e31c5dd0ca7621d715a0f5dbce0c73a82c6037d497bdb5b393e1c4809afb967d682e211b23012e114aaa82fffa4
SSDEEP

384:CHZONNPrmZqBwLYlQgAA4O84O3Lkn4YwFjvgEIgADEc1OZJPVcQ4AJgXnYPLQjyu:8ZshrmMM04PbYw5k3TOZJdcPAJ8O

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1508	1748	regsvr32.exe	28
PID 1748 wrote to memory of 1508	1748	regsvr32.exe	28
PID 1748 wrote to memory of 1508	1748	regsvr32.exe	28
PID 1748 wrote to memory of 1508	1748	regsvr32.exe	28
PID 1748 wrote to memory of 1508	1748	regsvr32.exe	28
PID 1748 wrote to memory of 1508	1748	regsvr32.exe	28
PID 1748 wrote to memory of 1508	1748	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\TheWorldPortable\Application\6.2.0.128\plugins\npactivex.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\TheWorldPortable\Application\6.2.0.128\plugins\npactivex.dll
  2⤵
  PID:1508

memory/1508-56-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download
memory/1748-54-0x000007FEFC201000-0x000007FEFC203000-memory.dmp

Filesize
8KB

Download