f276c2c64b4d07caec9cc1a580d0fcc43ddeee2a8b3b2a3dd877df2f71edc95e

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 16:59

Target

f276c2c64b4d07caec9cc1a580d0fcc43ddeee2a8b3b2a3dd877df2f71edc95e.dll
Size

619KB
MD5

fbe44fd4369c0e9d5c9426260a613646
SHA1

48419adeaa791b8a8ee8b5b6b4bba1a21ddc9af7
SHA256

f276c2c64b4d07caec9cc1a580d0fcc43ddeee2a8b3b2a3dd877df2f71edc95e
SHA512

734dda5ed40f1d55cff55a95464db439abebf35541634bbc6fffcea7bb8ff5d300199c22705fd7b4e192816e40576412cdd1221eeea511bdc5968e0fe042bf08
SSDEEP

12288:8hhE59soLE8MdUSNFU4dZooEDfXKtocn7BnwAF:XkUSwmeoEDaS2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 2036	1408	regsvr32.exe	27
PID 1408 wrote to memory of 2036	1408	regsvr32.exe	27
PID 1408 wrote to memory of 2036	1408	regsvr32.exe	27
PID 1408 wrote to memory of 2036	1408	regsvr32.exe	27
PID 1408 wrote to memory of 2036	1408	regsvr32.exe	27
PID 1408 wrote to memory of 2036	1408	regsvr32.exe	27
PID 1408 wrote to memory of 2036	1408	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f276c2c64b4d07caec9cc1a580d0fcc43ddeee2a8b3b2a3dd877df2f71edc95e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f276c2c64b4d07caec9cc1a580d0fcc43ddeee2a8b3b2a3dd877df2f71edc95e.dll
  2⤵
  PID:2036

memory/1408-54-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Filesize
8KB

Download
memory/2036-56-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download