a66b9e02ae7bd9a89669c482295e25ea00d87e4b08ccb1668469208f97d65fbe

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 20:02

Target

a66b9e02ae7bd9a89669c482295e25ea00d87e4b08ccb1668469208f97d65fbe.dll
Size

588KB
MD5

4ec2adb9fdc9b763fdbde846633aff55
SHA1

48bc3c65a20154c4660273742d5f52b892353112
SHA256

a66b9e02ae7bd9a89669c482295e25ea00d87e4b08ccb1668469208f97d65fbe
SHA512

0d6818db8ae600f71aa72ad3a8d791b13ac6ca3605cf8bd6f888834496751afe85fb89b12f8d792c4baea9b3a43b095ca1df6ba835c35b21e01308ec806f11b8
SSDEEP

768:FAI9UI1cq0WxG0T2d2hXZq/oCT6Uv2h3PNnVftA2oT4qVx4nX9iAVRGPZMo7zR0/:u2UgeCFTC2tO2UOJN82oT4qoN5Tfou/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1240	1052	regsvr32.exe	28
PID 1052 wrote to memory of 1240	1052	regsvr32.exe	28
PID 1052 wrote to memory of 1240	1052	regsvr32.exe	28
PID 1052 wrote to memory of 1240	1052	regsvr32.exe	28
PID 1052 wrote to memory of 1240	1052	regsvr32.exe	28
PID 1052 wrote to memory of 1240	1052	regsvr32.exe	28
PID 1052 wrote to memory of 1240	1052	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a66b9e02ae7bd9a89669c482295e25ea00d87e4b08ccb1668469208f97d65fbe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a66b9e02ae7bd9a89669c482295e25ea00d87e4b08ccb1668469208f97d65fbe.dll
  2⤵
  PID:1240

memory/1052-54-0x000007FEFBC41000-0x000007FEFBC43000-memory.dmp

Filesize
8KB

Download
memory/1240-56-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download