c4cf42db89249791545834386e5d5531f37af813d51763130385b5f1ae60ced4

Analysis

max time kernel
3s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 20:13

Target

c4cf42db89249791545834386e5d5531f37af813d51763130385b5f1ae60ced4.dll
Size

18KB
MD5

36494cf6d3313521ce59973f8935da16
SHA1

7e1393edcb94bb3dbadcc1a7207508104448e2b6
SHA256

c4cf42db89249791545834386e5d5531f37af813d51763130385b5f1ae60ced4
SHA512

996c13bccd04228385e94032968204b87bf892f60a13eaf1e797ece01aadd2bb9130bad3a78b58d4e7709ad0898c31cebedcd6bd9434d50c371d7833ddec486a
SSDEEP

384:FODlm8ILnaA+sH4+bYxIOeTfdXhIWkh2N8SlsxY3:wBILnaVtSFxIVAVlkQ

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1372	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1372	2012	regsvr32.exe	28
PID 2012 wrote to memory of 1372	2012	regsvr32.exe	28
PID 2012 wrote to memory of 1372	2012	regsvr32.exe	28
PID 2012 wrote to memory of 1372	2012	regsvr32.exe	28
PID 2012 wrote to memory of 1372	2012	regsvr32.exe	28
PID 2012 wrote to memory of 1372	2012	regsvr32.exe	28
PID 2012 wrote to memory of 1372	2012	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c4cf42db89249791545834386e5d5531f37af813d51763130385b5f1ae60ced4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c4cf42db89249791545834386e5d5531f37af813d51763130385b5f1ae60ced4.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1372

memory/1372-56-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/2012-54-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Filesize
8KB

Download