63a803e129c7f957734043a1b7ee5b06a700f226ff0e8fc574130c4a2159b537

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 07:54

Target

63a803e129c7f957734043a1b7ee5b06a700f226ff0e8fc574130c4a2159b537.dll
Size

401KB
MD5

149047629eb1f6be8f44526b3e8d3459
SHA1

0be6931e7aa292d6e702ca8895ac0cdb33cb49f1
SHA256

63a803e129c7f957734043a1b7ee5b06a700f226ff0e8fc574130c4a2159b537
SHA512

b3164cdaebc21fac5d82c1d9039f4f35e3fdbde4b88d90fceff52fc70bc4852a9b06a14eedfb11ce626ce28cc48f170f7d5b093a39db4ac8e315b655aaeb579b
SSDEEP

12288:qZcfqnQsAqoCq3RH3M2W+2qQcbcMrQ237ofyV:qgZC0R8ErvEfs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 948	2028	regsvr32.exe	27
PID 2028 wrote to memory of 948	2028	regsvr32.exe	27
PID 2028 wrote to memory of 948	2028	regsvr32.exe	27
PID 2028 wrote to memory of 948	2028	regsvr32.exe	27
PID 2028 wrote to memory of 948	2028	regsvr32.exe	27
PID 2028 wrote to memory of 948	2028	regsvr32.exe	27
PID 2028 wrote to memory of 948	2028	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\63a803e129c7f957734043a1b7ee5b06a700f226ff0e8fc574130c4a2159b537.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\63a803e129c7f957734043a1b7ee5b06a700f226ff0e8fc574130c4a2159b537.dll
  2⤵
  PID:948

memory/948-56-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/2028-54-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download