eb47b9811a73730eab79552e612a640cef0e5e909833899438d466f3f1727208

Analysis

max time kernel
32s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 20:55

Target

eb47b9811a73730eab79552e612a640cef0e5e909833899438d466f3f1727208.dll
Size

236KB
MD5

7f73fa0058a84a56cf40c0a36c5e25cb
SHA1

882f4f8577dc0bab639a65702aac1f9385eeb82e
SHA256

eb47b9811a73730eab79552e612a640cef0e5e909833899438d466f3f1727208
SHA512

f2b80df84f6e26f7a20b94b70976031fe030ac8e6fac318ee813cbcdf5d534342748e2e399e95c4b0fcf2b93309f03c29f7ea43df05f86495b28b8fbd42e01df
SSDEEP

6144:H6t4H+dUu3HgNkm1dpHGnwpkzozZ/Lg8FXCQsrNUc:aqHuUCm1dpHGwuzozZ/Lg8kQ2Uc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1684	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1684	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1684	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1684	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1684	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1684	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1684	1668	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\eb47b9811a73730eab79552e612a640cef0e5e909833899438d466f3f1727208.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\eb47b9811a73730eab79552e612a640cef0e5e909833899438d466f3f1727208.dll
  2⤵
  PID:1684

memory/1668-54-0x000007FEFB881000-0x000007FEFB883000-memory.dmp

Filesize
8KB

Download
memory/1684-55-0x0000000000000000-mapping.dmp

Download
memory/1684-56-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download