7e9db72752eea3893286b3f8899a39c4a7d851a994b0a7940f84a49519c5c2fc

Analysis

max time kernel
26s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 02:45

Target

7e9db72752eea3893286b3f8899a39c4a7d851a994b0a7940f84a49519c5c2fc.dll
Size

588KB
MD5

835c7a700e4260d0a07c5335c0d99b53
SHA1

2c94dda60745c7a77508a6495b09553ae0da0e67
SHA256

7e9db72752eea3893286b3f8899a39c4a7d851a994b0a7940f84a49519c5c2fc
SHA512

1842035c2e7fa2659e1f100f30fdd51dfaa9742dee3629846c4b589a1d2ae034ed35f4a76586921210c6d9c29725af716452a687dd59d1edf27ff927e8d09a3f
SSDEEP

768:IxbiRs43z6YY2uXZ9hAVaAAStKIZ+2fJcwqVETAz4HMBbsjjRGPZMoJXcV:DsUY2IGI7IZ+nVETAzFs1foJI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 1244	1196	regsvr32.exe	28
PID 1196 wrote to memory of 1244	1196	regsvr32.exe	28
PID 1196 wrote to memory of 1244	1196	regsvr32.exe	28
PID 1196 wrote to memory of 1244	1196	regsvr32.exe	28
PID 1196 wrote to memory of 1244	1196	regsvr32.exe	28
PID 1196 wrote to memory of 1244	1196	regsvr32.exe	28
PID 1196 wrote to memory of 1244	1196	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7e9db72752eea3893286b3f8899a39c4a7d851a994b0a7940f84a49519c5c2fc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7e9db72752eea3893286b3f8899a39c4a7d851a994b0a7940f84a49519c5c2fc.dll
  2⤵
  PID:1244

memory/1196-54-0x000007FEFC071000-0x000007FEFC073000-memory.dmp

Filesize
8KB

Download
memory/1244-56-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download