4d66db64263c1556bed0ffe64f824a2b17e556353532b1ad760eee5dbcaad986

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 18:27

Target

4d66db64263c1556bed0ffe64f824a2b17e556353532b1ad760eee5dbcaad986.dll
Size

212KB
MD5

3bbccdb96d4ad6540a5140384bfbf3d0
SHA1

1a11051f1d8950ad444faf1be66747ac66cdfe1d
SHA256

4d66db64263c1556bed0ffe64f824a2b17e556353532b1ad760eee5dbcaad986
SHA512

6649486ee2b6458f7938ab0db861bb85982cb3af8c3e41595d12d046d8ea3fb83b49183491b091e99bdaa71b673dea453ed3d7c66d838b38aa2a3ad4b619d719
SSDEEP

3072:ULsqzxK02qEQCdxGYTxZ4NqgbdyYJiStxEm1LUu:U5g0KLeYTxZRLYJXjEC

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1368	1972	regsvr32.exe	28
PID 1972 wrote to memory of 1368	1972	regsvr32.exe	28
PID 1972 wrote to memory of 1368	1972	regsvr32.exe	28
PID 1972 wrote to memory of 1368	1972	regsvr32.exe	28
PID 1972 wrote to memory of 1368	1972	regsvr32.exe	28
PID 1972 wrote to memory of 1368	1972	regsvr32.exe	28
PID 1972 wrote to memory of 1368	1972	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4d66db64263c1556bed0ffe64f824a2b17e556353532b1ad760eee5dbcaad986.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4d66db64263c1556bed0ffe64f824a2b17e556353532b1ad760eee5dbcaad986.dll
  2⤵
  PID:1368

memory/1368-56-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1972-54-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Filesize
8KB

Download