a000ec9e76c325cc97bede23eb48430383b3661dbbf0dca282d4d69234b6070c

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 20:24

Target

a000ec9e76c325cc97bede23eb48430383b3661dbbf0dca282d4d69234b6070c.dll
Size

19KB
MD5

7cc54e922e574657c3899c2e67082175
SHA1

64389108fcd7431292cd79fbfca152b62d96fad6
SHA256

a000ec9e76c325cc97bede23eb48430383b3661dbbf0dca282d4d69234b6070c
SHA512

3c336ae744af0d6675f1b2737a2ea1538a89cc196ed5ca4cd484fc6df07da39412c0e7e4e5a462719e7a7952625f0acc90e4ae80d28a3816acc50a2b54877fe0
SSDEEP

384:eWWTEcWePKORLzOIB5X5mFh0V4wKOZk+SaJgD/JSu11B:VaKORLzOIBF5yCq8ZkTaqDp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 1960	828	regsvr32.exe	28
PID 828 wrote to memory of 1960	828	regsvr32.exe	28
PID 828 wrote to memory of 1960	828	regsvr32.exe	28
PID 828 wrote to memory of 1960	828	regsvr32.exe	28
PID 828 wrote to memory of 1960	828	regsvr32.exe	28
PID 828 wrote to memory of 1960	828	regsvr32.exe	28
PID 828 wrote to memory of 1960	828	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a000ec9e76c325cc97bede23eb48430383b3661dbbf0dca282d4d69234b6070c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a000ec9e76c325cc97bede23eb48430383b3661dbbf0dca282d4d69234b6070c.dll
  2⤵
  PID:1960

memory/828-54-0x000007FEFB881000-0x000007FEFB883000-memory.dmp

Filesize
8KB

Download
memory/1960-55-0x0000000000000000-mapping.dmp

Download
memory/1960-56-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download