d09ac628f08bfa98bf6a5a21887533b95e25b594ee07cc91ef84d8a91ca2bdc9

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 20:10

Target

d09ac628f08bfa98bf6a5a21887533b95e25b594ee07cc91ef84d8a91ca2bdc9.dll
Size

19KB
MD5

15cc92ae97b918278097e2d0285612f4
SHA1

915673ff64614fe3a6feeb2545a6668dcc6fdfe9
SHA256

d09ac628f08bfa98bf6a5a21887533b95e25b594ee07cc91ef84d8a91ca2bdc9
SHA512

f216ffa90962b0df642abb83e7047ff11419045622fba21584dba62785577b553e3dfbd45156bd70015752a098aabcc4b701efb206357f1562f5f5c692b004b1
SSDEEP

384:4WWTEcWGPJO3U2ztAwRXVRDjaoxAkQR20qS/Tzp0NJNiFBqCACpSm:zqQD+AfqkQwEANiBqCXph

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1220	1380	regsvr32.exe	27
PID 1380 wrote to memory of 1220	1380	regsvr32.exe	27
PID 1380 wrote to memory of 1220	1380	regsvr32.exe	27
PID 1380 wrote to memory of 1220	1380	regsvr32.exe	27
PID 1380 wrote to memory of 1220	1380	regsvr32.exe	27
PID 1380 wrote to memory of 1220	1380	regsvr32.exe	27
PID 1380 wrote to memory of 1220	1380	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d09ac628f08bfa98bf6a5a21887533b95e25b594ee07cc91ef84d8a91ca2bdc9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d09ac628f08bfa98bf6a5a21887533b95e25b594ee07cc91ef84d8a91ca2bdc9.dll
  2⤵
  PID:1220

memory/1220-55-0x0000000000000000-mapping.dmp

Download
memory/1220-56-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/1380-54-0x000007FEFC291000-0x000007FEFC293000-memory.dmp

Filesize
8KB

Download