dcf4d8e9b5f3b1665483e603f974f5740ac3345105ea709cf2e73ec376bd77c7

Analysis

max time kernel
64s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 20:49

Target

dcf4d8e9b5f3b1665483e603f974f5740ac3345105ea709cf2e73ec376bd77c7.dll
Size

132KB
MD5

71fdc473252067e7495e14c2a9341c90
SHA1

271f83c09ef47242288c5320751c488cd2d0473d
SHA256

dcf4d8e9b5f3b1665483e603f974f5740ac3345105ea709cf2e73ec376bd77c7
SHA512

eac62d7f70aee2ec9962acaf3b40ad8f1397ace91f87fd055bd90490ec7f947b26f0cc53bcbe4cdcdb794c14b4ca3e429f9671cbb1945014fb1442856a3d6cf6
SSDEEP

1536:7AMq1pUQ25MTaopejcTx/qkjIHR29TXNDx:0o52npeoIMIx29TD

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1108	1644	regsvr32.exe	28
PID 1644 wrote to memory of 1108	1644	regsvr32.exe	28
PID 1644 wrote to memory of 1108	1644	regsvr32.exe	28
PID 1644 wrote to memory of 1108	1644	regsvr32.exe	28
PID 1644 wrote to memory of 1108	1644	regsvr32.exe	28
PID 1644 wrote to memory of 1108	1644	regsvr32.exe	28
PID 1644 wrote to memory of 1108	1644	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dcf4d8e9b5f3b1665483e603f974f5740ac3345105ea709cf2e73ec376bd77c7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dcf4d8e9b5f3b1665483e603f974f5740ac3345105ea709cf2e73ec376bd77c7.dll
  2⤵
  PID:1108

memory/1108-56-0x00000000763D1000-0x00000000763D3000-memory.dmp

Filesize
8KB

Download
memory/1644-54-0x000007FEFC131000-0x000007FEFC133000-memory.dmp

Filesize
8KB

Download