224dbad36beaf8c59e1a9eb534568816019b4b53b51e21c283f481a24e26a4b8

Analysis

max time kernel
2s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 00:36

Target

224dbad36beaf8c59e1a9eb534568816019b4b53b51e21c283f481a24e26a4b8.dll
Size

128KB
MD5

36673c8ce24b61621940435ff113bcb0
SHA1

65fdf4d0cd292a1e62ba530ce7f7eec4bd391dc5
SHA256

224dbad36beaf8c59e1a9eb534568816019b4b53b51e21c283f481a24e26a4b8
SHA512

4eb4d9d43c271b595e448c44cc6b2d7513d6b9f98dcc1e34e1ab8472a9e9f6fe5a6f35c62428dc33746c3abd4edef9424fe85103e55c48e90b01727e1cdf41da
SSDEEP

1536:NDfR/ho2LeV/dFPzmqiTyaDLhYETtyGqgo+XosUFmu1k6:NhhDeV/rPz7oqHGDo+XosUUu1k6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 960	1948	regsvr32.exe	28
PID 1948 wrote to memory of 960	1948	regsvr32.exe	28
PID 1948 wrote to memory of 960	1948	regsvr32.exe	28
PID 1948 wrote to memory of 960	1948	regsvr32.exe	28
PID 1948 wrote to memory of 960	1948	regsvr32.exe	28
PID 1948 wrote to memory of 960	1948	regsvr32.exe	28
PID 1948 wrote to memory of 960	1948	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\224dbad36beaf8c59e1a9eb534568816019b4b53b51e21c283f481a24e26a4b8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\224dbad36beaf8c59e1a9eb534568816019b4b53b51e21c283f481a24e26a4b8.dll
  2⤵
  PID:960

memory/960-56-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1948-54-0x000007FEFC631000-0x000007FEFC633000-memory.dmp

Filesize
8KB

Download