441f401f5e628cdf0fcc37f34674c850459aaed4bdce1d9e6b96af4948c506c0

Analysis

max time kernel
4s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 20:16

Target

441f401f5e628cdf0fcc37f34674c850459aaed4bdce1d9e6b96af4948c506c0.dll
Size

128KB
MD5

045a77c71429f8295c40eee1121918a0
SHA1

eca46fc73b136b2115ebc4fb324b163cbf502d9c
SHA256

441f401f5e628cdf0fcc37f34674c850459aaed4bdce1d9e6b96af4948c506c0
SHA512

a3a30df0d6d2269f72400e00eb9b91457ca50cfc97e819ba41e66945d38c588dfaeb882146cf4e3034b4686d832433b71e2f1736fda8c690106161c773ea8ddf
SSDEEP

1536:0AiqtQIEXi+/kAC+5pnnuB1aqRPMjoKv3D+:ZJ0h8kpnniFhUq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1520	2032	regsvr32.exe	28
PID 2032 wrote to memory of 1520	2032	regsvr32.exe	28
PID 2032 wrote to memory of 1520	2032	regsvr32.exe	28
PID 2032 wrote to memory of 1520	2032	regsvr32.exe	28
PID 2032 wrote to memory of 1520	2032	regsvr32.exe	28
PID 2032 wrote to memory of 1520	2032	regsvr32.exe	28
PID 2032 wrote to memory of 1520	2032	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\441f401f5e628cdf0fcc37f34674c850459aaed4bdce1d9e6b96af4948c506c0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\441f401f5e628cdf0fcc37f34674c850459aaed4bdce1d9e6b96af4948c506c0.dll
  2⤵
  PID:1520

memory/1520-55-0x0000000000000000-mapping.dmp

Download
memory/1520-56-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download
memory/2032-54-0x000007FEFB881000-0x000007FEFB883000-memory.dmp

Filesize
8KB

Download