9e345b1e73f1e5ec6654d12eca1f20649cb80be69fe141723d966d3a2cdd0783

Analysis

max time kernel
59s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 20:16

Target

9e345b1e73f1e5ec6654d12eca1f20649cb80be69fe141723d966d3a2cdd0783.dll
Size

128KB
MD5

fef0be069466859be6052d41890e1080
SHA1

078fa1ac33a14f259d50d42f4039a71f9180e68c
SHA256

9e345b1e73f1e5ec6654d12eca1f20649cb80be69fe141723d966d3a2cdd0783
SHA512

eeac262a75f93c2d0c69149f1567c73646458665bcc2be30d376f8b255202c6d4531d7399324b4ace621653849937f4ca163b6831dbdf0a4b5617f91c389ed2c
SSDEEP

1536:3mqvQVHXWRXjWm5YO6w9E3hy3FVhtoueZIbBz:N03WJjNuw9oo3F/CueZ8

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1016	1892	regsvr32.exe	28
PID 1892 wrote to memory of 1016	1892	regsvr32.exe	28
PID 1892 wrote to memory of 1016	1892	regsvr32.exe	28
PID 1892 wrote to memory of 1016	1892	regsvr32.exe	28
PID 1892 wrote to memory of 1016	1892	regsvr32.exe	28
PID 1892 wrote to memory of 1016	1892	regsvr32.exe	28
PID 1892 wrote to memory of 1016	1892	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9e345b1e73f1e5ec6654d12eca1f20649cb80be69fe141723d966d3a2cdd0783.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9e345b1e73f1e5ec6654d12eca1f20649cb80be69fe141723d966d3a2cdd0783.dll
  2⤵
  PID:1016

memory/1016-56-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download
memory/1892-54-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmp

Filesize
8KB

Download