cfa63699e41a8e32e99c14b9cd7d0937a9b60cd28f1aeac029df6b7f392d6888

Analysis

max time kernel
227s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 20:11

Target

cfa63699e41a8e32e99c14b9cd7d0937a9b60cd28f1aeac029df6b7f392d6888.dll
Size

120KB
MD5

6fd938e8dc821766e06a72d25cb6b090
SHA1

e7075bfc3770c11e0949ddedc9617c7981cfd118
SHA256

cfa63699e41a8e32e99c14b9cd7d0937a9b60cd28f1aeac029df6b7f392d6888
SHA512

adb64bd1c770c5cc64552b5cfc399efe96c2b0aa942c99e3f523370ee16632ce0d99cdee5763aa0140522206e529e5370027068944091dff5e82f304425ecab6
SSDEEP

768:w5tayhq4QC+IcV4bbVPt8+5bKi5OZvdczmwwRUsWLN45YmvOHuZjdAWwCSXBJeUA:Yhq4Qcemp3z5OZLUF45TOShAuSxJe9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 1168	1116	regsvr32.exe	28
PID 1116 wrote to memory of 1168	1116	regsvr32.exe	28
PID 1116 wrote to memory of 1168	1116	regsvr32.exe	28
PID 1116 wrote to memory of 1168	1116	regsvr32.exe	28
PID 1116 wrote to memory of 1168	1116	regsvr32.exe	28
PID 1116 wrote to memory of 1168	1116	regsvr32.exe	28
PID 1116 wrote to memory of 1168	1116	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cfa63699e41a8e32e99c14b9cd7d0937a9b60cd28f1aeac029df6b7f392d6888.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cfa63699e41a8e32e99c14b9cd7d0937a9b60cd28f1aeac029df6b7f392d6888.dll
  2⤵
  PID:1168

memory/1116-54-0x000007FEFC0B1000-0x000007FEFC0B3000-memory.dmp

Filesize
8KB

Download
memory/1168-56-0x0000000076931000-0x0000000076933000-memory.dmp

Filesize
8KB

Download