935697cf52195e8d11ca283e61d0a384f2462e13afb1145903e4e7458a5bba11

Analysis

max time kernel
32s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 07:33

Target

935697cf52195e8d11ca283e61d0a384f2462e13afb1145903e4e7458a5bba11.dll
Size

256KB
MD5

1f8ac9065205b00156f67c55eac23e45
SHA1

530a2603bc0f5168d862397c92186f944e33d50b
SHA256

935697cf52195e8d11ca283e61d0a384f2462e13afb1145903e4e7458a5bba11
SHA512

7b58bc44f245091e8296fa57dcbe0c2ee7c2939db92ab01f1ced25679dcfe06769c09b178684e4eb2b7f904b6d7639252153db00e4dd00d4547adf0ac30a9a93
SSDEEP

6144:oma83qfjkCzqmgsNstyJU18vE1gKKC0e6:omjmgsnygKKB

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 1968	1392	regsvr32.exe	28
PID 1392 wrote to memory of 1968	1392	regsvr32.exe	28
PID 1392 wrote to memory of 1968	1392	regsvr32.exe	28
PID 1392 wrote to memory of 1968	1392	regsvr32.exe	28
PID 1392 wrote to memory of 1968	1392	regsvr32.exe	28
PID 1392 wrote to memory of 1968	1392	regsvr32.exe	28
PID 1392 wrote to memory of 1968	1392	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\935697cf52195e8d11ca283e61d0a384f2462e13afb1145903e4e7458a5bba11.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\935697cf52195e8d11ca283e61d0a384f2462e13afb1145903e4e7458a5bba11.dll
  2⤵
  PID:1968

memory/1392-54-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

Filesize
8KB

Download
memory/1968-56-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download