90dad8c764a0847d6bf32b1adfb3457e390f799c756bf914bae00ffec841fdd7

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 20:47

Target

90dad8c764a0847d6bf32b1adfb3457e390f799c756bf914bae00ffec841fdd7.dll
Size

120KB
MD5

776454642ceeb9dbaca0e72050ff18e0
SHA1

9730933724af21b8e411c00c7fdc5dce11a44fe1
SHA256

90dad8c764a0847d6bf32b1adfb3457e390f799c756bf914bae00ffec841fdd7
SHA512

76ec3c34ccf65b860bd2c3891520b9d0078d3f1253e9f1218a140330ee64c2f2b5387e17004722eefd889ed4f8d0481cfbae941ea2ef5fba1675c07ce6e6d808
SSDEEP

1536:wlqcQf8EVmtoAap73Q+jZsVsiuxnf2j1Dezys:Ow8Eyrap8YsVfuxfY1iGs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 872	896	regsvr32.exe	27
PID 896 wrote to memory of 872	896	regsvr32.exe	27
PID 896 wrote to memory of 872	896	regsvr32.exe	27
PID 896 wrote to memory of 872	896	regsvr32.exe	27
PID 896 wrote to memory of 872	896	regsvr32.exe	27
PID 896 wrote to memory of 872	896	regsvr32.exe	27
PID 896 wrote to memory of 872	896	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\90dad8c764a0847d6bf32b1adfb3457e390f799c756bf914bae00ffec841fdd7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\90dad8c764a0847d6bf32b1adfb3457e390f799c756bf914bae00ffec841fdd7.dll
  2⤵
  PID:872

memory/872-56-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/896-54-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

Filesize
8KB

Download