6ce180935cb4f1f4016f12612ca165dcd007fd3ab6804bebffdb053f65e460ad

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 03:33

Target

6ce180935cb4f1f4016f12612ca165dcd007fd3ab6804bebffdb053f65e460ad.dll
Size

128KB
MD5

709df784a601526091eb0e19ce482fe0
SHA1

0702605656f22191f0208c638241158d35836eb8
SHA256

6ce180935cb4f1f4016f12612ca165dcd007fd3ab6804bebffdb053f65e460ad
SHA512

2cc943712181cd5ebc7083f6ba8d7dd25ecdffe3888808e0e2c2e8956da262c7a990d4f6c5d8af0c65bd58435722b064703940e7e3028cac33739c43660c3a97
SSDEEP

1536:yRUge/yTC2tOmXbJVaK3R0XMJ33iU5hVXl7NeLZ61due6moMNNlltdgHXTzHrz0Q:+TTOubqoNNfoL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6ce180935cb4f1f4016f12612ca165dcd007fd3ab6804bebffdb053f65e460ad.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6ce180935cb4f1f4016f12612ca165dcd007fd3ab6804bebffdb053f65e460ad.dll
  2⤵
  PID:1388

memory/1048-54-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download
memory/1388-56-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download