89acb0ce46e83e1215f15154cde67b54325aaa20af3d1ebea5692f5c75643361

Analysis

max time kernel
41s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 18:05

Target

89acb0ce46e83e1215f15154cde67b54325aaa20af3d1ebea5692f5c75643361.dll
Size

232KB
MD5

eb826b6a39f4ea59fc9222c9f0baea97
SHA1

9e7fc2a892e47cc0b6503dbb1bb71d52ee5a1dfb
SHA256

89acb0ce46e83e1215f15154cde67b54325aaa20af3d1ebea5692f5c75643361
SHA512

717e290d4000032582723c857fa45c77e1b7b824fbc77a1155da44c03e6d565ec914818e677fa1cdf65b03b28b6a986adb37d6654479de73331df2e42632e8fd
SSDEEP

3072:PCnapABw3XFFsiap4ecuicpeobdFCztherbP6O/mgkj6eXyOsQC1Chxw/A5xlZj7:PCnatToSVO/mgNeEk4gxlZjiWll

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1900	1940	regsvr32.exe	28
PID 1940 wrote to memory of 1900	1940	regsvr32.exe	28
PID 1940 wrote to memory of 1900	1940	regsvr32.exe	28
PID 1940 wrote to memory of 1900	1940	regsvr32.exe	28
PID 1940 wrote to memory of 1900	1940	regsvr32.exe	28
PID 1940 wrote to memory of 1900	1940	regsvr32.exe	28
PID 1940 wrote to memory of 1900	1940	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\89acb0ce46e83e1215f15154cde67b54325aaa20af3d1ebea5692f5c75643361.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\89acb0ce46e83e1215f15154cde67b54325aaa20af3d1ebea5692f5c75643361.dll
  2⤵
  PID:1900

memory/1900-56-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1940-54-0x000007FEFC621000-0x000007FEFC623000-memory.dmp

Filesize
8KB

Download