425d0a1cbea98b034de9b9006499e8cd2aec1db38b314dfac08a0245f7a15015

Analysis

max time kernel
3s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 20:15

Target

425d0a1cbea98b034de9b9006499e8cd2aec1db38b314dfac08a0245f7a15015.dll
Size

128KB
MD5

15dacd6a929658869205d7a7d3e30d50
SHA1

bacfe2155efe526500568426c502771eaabb1eac
SHA256

425d0a1cbea98b034de9b9006499e8cd2aec1db38b314dfac08a0245f7a15015
SHA512

ae1f5de2a60c087ea5ac84f323e987974b4d050ce4038a994da7afce521d921e33dd39bf27f45cb1cfeeaca3346e440755519dca24a8ebc3119655a4b4eacd3e
SSDEEP

1536:gZmqhQMpXMTB/8YxotARcrNHqlSCK2ReW:ypx2xUtnrNHQReW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 284	956	regsvr32.exe	28
PID 956 wrote to memory of 284	956	regsvr32.exe	28
PID 956 wrote to memory of 284	956	regsvr32.exe	28
PID 956 wrote to memory of 284	956	regsvr32.exe	28
PID 956 wrote to memory of 284	956	regsvr32.exe	28
PID 956 wrote to memory of 284	956	regsvr32.exe	28
PID 956 wrote to memory of 284	956	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\425d0a1cbea98b034de9b9006499e8cd2aec1db38b314dfac08a0245f7a15015.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\425d0a1cbea98b034de9b9006499e8cd2aec1db38b314dfac08a0245f7a15015.dll
  2⤵
  PID:284

memory/284-56-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/956-54-0x000007FEFBAF1000-0x000007FEFBAF3000-memory.dmp

Filesize
8KB

Download