46162c5d105f88a8d0571bb07f8d7951826688e4b6e075ba3b51ce7eefb44932

Analysis

max time kernel
41s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 20:15

Target

46162c5d105f88a8d0571bb07f8d7951826688e4b6e075ba3b51ce7eefb44932.dll
Size

116KB
MD5

7707a737120056f6f03a75a1e71411f0
SHA1

cb3b482e32f273a5c8e8222a4224daedd8a7f5db
SHA256

46162c5d105f88a8d0571bb07f8d7951826688e4b6e075ba3b51ce7eefb44932
SHA512

56d69b0db429e8e3b51dba9b6ae02f8fee06535d98777e4c6a157ad9b353468a14d17aef205ffb5336dc609f95c3ca6a221f6c5ff3665e06785d74c225bdaebc
SSDEEP

768:bRoiMoqZOpQGSI9o/fFz1y85pN7HpB5D29msJ/3LcFkb0/BVEt2tvJHyEIRlJ5e2:lvxqZoQee1H4RJTcFfpqtYJMlPeBIZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 964	1648	regsvr32.exe	28
PID 1648 wrote to memory of 964	1648	regsvr32.exe	28
PID 1648 wrote to memory of 964	1648	regsvr32.exe	28
PID 1648 wrote to memory of 964	1648	regsvr32.exe	28
PID 1648 wrote to memory of 964	1648	regsvr32.exe	28
PID 1648 wrote to memory of 964	1648	regsvr32.exe	28
PID 1648 wrote to memory of 964	1648	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\46162c5d105f88a8d0571bb07f8d7951826688e4b6e075ba3b51ce7eefb44932.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\46162c5d105f88a8d0571bb07f8d7951826688e4b6e075ba3b51ce7eefb44932.dll
  2⤵
  PID:964

memory/964-55-0x0000000000000000-mapping.dmp

Download
memory/964-56-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download
memory/1648-54-0x000007FEFB851000-0x000007FEFB853000-memory.dmp

Filesize
8KB

Download