3f58a7d62952a7f26a5fcc69778ebf51d14adfd93ba2d6d5f5aa71f08f18d831

Analysis

max time kernel
22s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 04:57

Target

3f58a7d62952a7f26a5fcc69778ebf51d14adfd93ba2d6d5f5aa71f08f18d831.dll
Size

128KB
MD5

4a907a3a8edbeea4d7f256def6a5ba40
SHA1

cdf29180abe76ee0853b85c927fe8662fec25f4a
SHA256

3f58a7d62952a7f26a5fcc69778ebf51d14adfd93ba2d6d5f5aa71f08f18d831
SHA512

93d40370016a2664ebdf6d3f34efdf4a04cc80bca91b3f28f1ef91e3ee66115068b52be9c9295a68ca124ca2a40d414bc171d30abc7e0404b06aad2467665035
SSDEEP

1536:aDfR/+o2LeV/dFPzmqiTyaDLhYETtyGqgo+XosiFmu1k6:ah+DeV/rPz7oqHGDo+XosiUu1k6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 928	884	regsvr32.exe	27
PID 884 wrote to memory of 928	884	regsvr32.exe	27
PID 884 wrote to memory of 928	884	regsvr32.exe	27
PID 884 wrote to memory of 928	884	regsvr32.exe	27
PID 884 wrote to memory of 928	884	regsvr32.exe	27
PID 884 wrote to memory of 928	884	regsvr32.exe	27
PID 884 wrote to memory of 928	884	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3f58a7d62952a7f26a5fcc69778ebf51d14adfd93ba2d6d5f5aa71f08f18d831.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3f58a7d62952a7f26a5fcc69778ebf51d14adfd93ba2d6d5f5aa71f08f18d831.dll
  2⤵
  PID:928

memory/884-54-0x000007FEFB731000-0x000007FEFB733000-memory.dmp

Filesize
8KB

Download
memory/928-56-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download