7959ff7e17583f8d98c4ed991c4f254557f0376bc06f00f08421c0ed94ffc137

Analysis

max time kernel
132s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 07:23

Target

7959ff7e17583f8d98c4ed991c4f254557f0376bc06f00f08421c0ed94ffc137.dll
Size

588KB
MD5

22741a48a52c2dcd9ed8a75fe224d0f0
SHA1

91467f4886d70bb6de848af3654d47a6cc285f42
SHA256

7959ff7e17583f8d98c4ed991c4f254557f0376bc06f00f08421c0ed94ffc137
SHA512

f04cf3ec5678b7298b70f8dbc32b81e4c79c9d99143abfd587da3c16c5971041f7cf84b1427366e960142eb7c91f20b26876f36a22e3c98457c76581069b048a
SSDEEP

768:5S8e8s8YY2uXZ9hAVawuStKIZ+2fJcwqVETAz4HMBbsjjRGPZMoO4pV:VwY2IGe7IZ+nVETAzFs1foO43

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 704	4528	regsvr32.exe	82
PID 4528 wrote to memory of 704	4528	regsvr32.exe	82
PID 4528 wrote to memory of 704	4528	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7959ff7e17583f8d98c4ed991c4f254557f0376bc06f00f08421c0ed94ffc137.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7959ff7e17583f8d98c4ed991c4f254557f0376bc06f00f08421c0ed94ffc137.dll
  2⤵
  PID:704