71fbfb1f45574e329bb088b6dbd88d3515595b83feae55f9b617bda31b9032de

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 04:33

Target

71fbfb1f45574e329bb088b6dbd88d3515595b83feae55f9b617bda31b9032de.dll
Size

120KB
MD5

3fa7c20d918a56a869124b7333f91ca9
SHA1

5de6d15516c06f0d4f910c9238a994837333e2e1
SHA256

71fbfb1f45574e329bb088b6dbd88d3515595b83feae55f9b617bda31b9032de
SHA512

cff00aa2abeba3b17063056ade5e4a9b3a98e5a3aaaea2022d21d45c84204eb3f43c9ad47c0a53c93e0b885fbd94fd8acd13d42418975be9cc3fe25270d7b2ae
SSDEEP

768:K5tayhq4QC+IcV4bbVPt8+5bKi5OZvdczmwwR8sWLN45YmvOHuZjdAWwCSXBJeUS:uhq4Qcemp3z5OZL8F45TOShAuSxJe3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1412	1512	regsvr32.exe	26
PID 1512 wrote to memory of 1412	1512	regsvr32.exe	26
PID 1512 wrote to memory of 1412	1512	regsvr32.exe	26
PID 1512 wrote to memory of 1412	1512	regsvr32.exe	26
PID 1512 wrote to memory of 1412	1512	regsvr32.exe	26
PID 1512 wrote to memory of 1412	1512	regsvr32.exe	26
PID 1512 wrote to memory of 1412	1512	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\71fbfb1f45574e329bb088b6dbd88d3515595b83feae55f9b617bda31b9032de.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\71fbfb1f45574e329bb088b6dbd88d3515595b83feae55f9b617bda31b9032de.dll
  2⤵
  PID:1412

memory/1412-56-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/1512-54-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

Filesize
8KB

Download