289b2014c8e53e2a350240de2fd147f7da4768dbfb1a930882a5cc8d130d31c4

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 05:28

Target

289b2014c8e53e2a350240de2fd147f7da4768dbfb1a930882a5cc8d130d31c4.dll
Size

52KB
MD5

cd7ece28be0f149c5e4300be9603e330
SHA1

c2c1c06b8dbcef2b835feaca52461e394aa18b48
SHA256

289b2014c8e53e2a350240de2fd147f7da4768dbfb1a930882a5cc8d130d31c4
SHA512

947d73102f964c4a25f2cbd75f16858893771a71991a824e642f0cb9520358965affd45ebda480332387e98b911746e63bfbe01cb9cfa3c3cd638c607084e3b8
SSDEEP

768:ci21pSRDOXkZGkjrx2jNeiKTHoZ81+IfSEPtMgrRcTIFXeo5XU1oxe:z218tBh4js8mtR0IFXez1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 1536	768	regsvr32.exe	27
PID 768 wrote to memory of 1536	768	regsvr32.exe	27
PID 768 wrote to memory of 1536	768	regsvr32.exe	27
PID 768 wrote to memory of 1536	768	regsvr32.exe	27
PID 768 wrote to memory of 1536	768	regsvr32.exe	27
PID 768 wrote to memory of 1536	768	regsvr32.exe	27
PID 768 wrote to memory of 1536	768	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\289b2014c8e53e2a350240de2fd147f7da4768dbfb1a930882a5cc8d130d31c4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\289b2014c8e53e2a350240de2fd147f7da4768dbfb1a930882a5cc8d130d31c4.dll
  2⤵
  PID:1536

memory/768-54-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

Filesize
8KB

Download
memory/1536-56-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download