ad653ec99785511e29f43685dfd8ea7b4c882f0c0d7ba5b6db8de5703b96f05e

Analysis

max time kernel
37s
max time network
101s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 03:20

Target

ad653ec99785511e29f43685dfd8ea7b4c882f0c0d7ba5b6db8de5703b96f05e.dll
Size

186KB
MD5

6d554667ce3e78a622d2159e6508a006
SHA1

ce715bb8e3af0e6446ca92a3deb000487cd4ccdb
SHA256

ad653ec99785511e29f43685dfd8ea7b4c882f0c0d7ba5b6db8de5703b96f05e
SHA512

6096a28261c784a94d06a5397549793ba71ea64465a6df004cf995eb0a15228152a315073c968629bf2edfe2a7b7bcec7d27db4f1267c4c5e1f2a0da1b1511a2
SSDEEP

3072:6hjTY5+hjTY5+hjTY5+hjTY5+hjTY5+hjTY5:6lThlThlThlThlThlT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1580	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1580	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1580	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1580	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1580	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1580	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1580	1672	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ad653ec99785511e29f43685dfd8ea7b4c882f0c0d7ba5b6db8de5703b96f05e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ad653ec99785511e29f43685dfd8ea7b4c882f0c0d7ba5b6db8de5703b96f05e.dll
  2⤵
  PID:1580

memory/1580-56-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/1580-57-0x0000000000170000-0x000000000017D000-memory.dmp

Filesize
52KB

Download
memory/1672-54-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

Filesize
8KB

Download