2d651c5a3535e38b75947ef4367e640ca2963f90eb3a5d9e7a60c1aaaabefd26

Analysis

max time kernel
6s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 20:14

Target

2d651c5a3535e38b75947ef4367e640ca2963f90eb3a5d9e7a60c1aaaabefd26.dll
Size

120KB
MD5

76ff8b61ca7ece9d1733c20a5e1b2490
SHA1

a156b57f5e27efa7654fde6ca5e42f1d8681295a
SHA256

2d651c5a3535e38b75947ef4367e640ca2963f90eb3a5d9e7a60c1aaaabefd26
SHA512

ba3e6fb5e7eb339272cbe7e2228584af35385ac4b8f7b8ade6964a1f0603ba1ed71aa459e934383d9c16cd174642a59ff29527c18af5f9eb5931abe4392d94a3
SSDEEP

1536:cxqiQ5wGb3TFO1UKPmdWYtDheR+7ecAgBJosMOGnR:YCw+g6K8Z5w07e9gBGlRR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1600	1672	regsvr32.exe	28
PID 1672 wrote to memory of 1600	1672	regsvr32.exe	28
PID 1672 wrote to memory of 1600	1672	regsvr32.exe	28
PID 1672 wrote to memory of 1600	1672	regsvr32.exe	28
PID 1672 wrote to memory of 1600	1672	regsvr32.exe	28
PID 1672 wrote to memory of 1600	1672	regsvr32.exe	28
PID 1672 wrote to memory of 1600	1672	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2d651c5a3535e38b75947ef4367e640ca2963f90eb3a5d9e7a60c1aaaabefd26.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2d651c5a3535e38b75947ef4367e640ca2963f90eb3a5d9e7a60c1aaaabefd26.dll
  2⤵
  PID:1600

memory/1600-56-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1672-54-0x000007FEFB901000-0x000007FEFB903000-memory.dmp

Filesize
8KB

Download