1fc0c7595fa51dcd786582ee802b27f988f7194e83458f8abf22ea2303a6d700

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 13:05

Target

1fc0c7595fa51dcd786582ee802b27f988f7194e83458f8abf22ea2303a6d700.dll
Size

1.5MB
MD5

2ee72dcbeb64170cda0f021db85921f3
SHA1

47932c71871db752f5c1fa1676dd5257d0088092
SHA256

1fc0c7595fa51dcd786582ee802b27f988f7194e83458f8abf22ea2303a6d700
SHA512

4222d4be45cdac8f71dd655c549eca6e2dc6846b041a9d8aba8e9847bdb2b5313188c3b4cf375272414429fe81b644850ecbfc6e2f4e8720ad2673e52b776030
SSDEEP

384:dV4cigsBljIMtncRrtDC9tgtDsmpjor2FCjuXcwTbW532uE0kqUUslrLhfgCxiMM:TKjjIMtcRrtmgtQmpkrE0uXu123hfFxq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2016	1896	regsvr32.exe	27
PID 1896 wrote to memory of 2016	1896	regsvr32.exe	27
PID 1896 wrote to memory of 2016	1896	regsvr32.exe	27
PID 1896 wrote to memory of 2016	1896	regsvr32.exe	27
PID 1896 wrote to memory of 2016	1896	regsvr32.exe	27
PID 1896 wrote to memory of 2016	1896	regsvr32.exe	27
PID 1896 wrote to memory of 2016	1896	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1fc0c7595fa51dcd786582ee802b27f988f7194e83458f8abf22ea2303a6d700.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1fc0c7595fa51dcd786582ee802b27f988f7194e83458f8abf22ea2303a6d700.dll
  2⤵
  PID:2016

memory/1896-54-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download