6e789817556d81caa3285465bca01ec8b392cdec527fcc54073340e1e1f356c7

Analysis

max time kernel
6s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 23:01

Target

6e789817556d81caa3285465bca01ec8b392cdec527fcc54073340e1e1f356c7.dll
Size

588KB
MD5

bf28396489247705e3d06aba57a0c3bc
SHA1

f033ee7487a8e19292ef884444750dc0da4fb7ee
SHA256

6e789817556d81caa3285465bca01ec8b392cdec527fcc54073340e1e1f356c7
SHA512

2ada1b062bedadd3f7500bac90e9bf5a9fb5222758029aabcc5f83af50156c00335726c611669d55fda759c33e376c9c7ff2581f3ac9f9569f6dd48f43f72f88
SSDEEP

768:sS8e8rYY2uXZ9hAVawuStKIZ+2fJcwqVETAz4HMBbsjjRGPZMo1pV:GcY2IGe7IZ+nVETAzFs1fo13

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1696	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1696	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1696	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1696	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1696	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1696	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1696	1452	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6e789817556d81caa3285465bca01ec8b392cdec527fcc54073340e1e1f356c7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6e789817556d81caa3285465bca01ec8b392cdec527fcc54073340e1e1f356c7.dll
  2⤵
  PID:1696

memory/1452-54-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

Filesize
8KB

Download
memory/1696-55-0x0000000000000000-mapping.dmp

Download
memory/1696-56-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download