13f8e0f8c53ef2b4bf32ce2181ece4a297858b7aa295eeb48cf38afbf63ee3c9

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 10:45

Target

13f8e0f8c53ef2b4bf32ce2181ece4a297858b7aa295eeb48cf38afbf63ee3c9.dll
Size

588KB
MD5

56d99fba8a10928164caf86eb4e29470
SHA1

0a4a3b807bc54d93a81ff59eec9444e86c991581
SHA256

13f8e0f8c53ef2b4bf32ce2181ece4a297858b7aa295eeb48cf38afbf63ee3c9
SHA512

dac5293fdb012bf60ec3e928ae3359d784ad0aa00f2c8872547828d7832d2ecac7c721601d6b52607a441df33ec7b412337cf18eeeb2ba3fc4ec63d0409ec4ee
SSDEEP

1536:QGkmYRQcowbqwI81hDTlBSaDzdlK+hiKbZXwBBkH+6o3L7VNsU6:EmYRsanP1hrSaDzDZX2k+6o3LZGU6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1988	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1988	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1988	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1988	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1988	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1988	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1988	1048	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\13f8e0f8c53ef2b4bf32ce2181ece4a297858b7aa295eeb48cf38afbf63ee3c9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\13f8e0f8c53ef2b4bf32ce2181ece4a297858b7aa295eeb48cf38afbf63ee3c9.dll
  2⤵
  PID:1988

memory/1048-54-0x000007FEFC281000-0x000007FEFC283000-memory.dmp

Filesize
8KB

Download
memory/1988-55-0x0000000000000000-mapping.dmp

Download
memory/1988-56-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download