c408cb6f64b3b7944a135b681a54acbe6c11159e109b423a5b85d3cdf2988698

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 09:44

Target

c408cb6f64b3b7944a135b681a54acbe6c11159e109b423a5b85d3cdf2988698.dll
Size

111KB
MD5

48726772be96c6e5a676afca78ea442e
SHA1

74a9b759e8dc1ccd69564c4857c9f15bd9e96c77
SHA256

c408cb6f64b3b7944a135b681a54acbe6c11159e109b423a5b85d3cdf2988698
SHA512

bf8b0c868855c2a00341924620bd213076fff8adb017943a4e1c4bd74a60a7772b2962504668696fe1efb9b84b051305f26f5b3b1bcc7a83484c728b6de08875
SSDEEP

1536:R5UfVZv6h9jo2rql+ERXuSclSFfL3eoxta2OMdj3KdQX:R5UP6hKRXuS6S9L3e2ta2OMdj3Ka

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1696	1368	regsvr32.exe	16
PID 1368 wrote to memory of 1696	1368	regsvr32.exe	16
PID 1368 wrote to memory of 1696	1368	regsvr32.exe	16
PID 1368 wrote to memory of 1696	1368	regsvr32.exe	16
PID 1368 wrote to memory of 1696	1368	regsvr32.exe	16
PID 1368 wrote to memory of 1696	1368	regsvr32.exe	16
PID 1368 wrote to memory of 1696	1368	regsvr32.exe	16

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c408cb6f64b3b7944a135b681a54acbe6c11159e109b423a5b85d3cdf2988698.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c408cb6f64b3b7944a135b681a54acbe6c11159e109b423a5b85d3cdf2988698.dll
  2⤵
  PID:1696

memory/1368-54-0x000007FEFB641000-0x000007FEFB643000-memory.dmp

Filesize
8KB

Download
memory/1696-56-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download