c75197d845097c3449a4ba4ec8480ae2ba5009949c4727363ef7627f50983f29

Analysis

max time kernel
10s
max time network
53s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 23:42

Target

c75197d845097c3449a4ba4ec8480ae2ba5009949c4727363ef7627f50983f29.dll
Size

52KB
MD5

692241dd119ee988defb4c49fc64fe40
SHA1

4194c7de9c1a3614a23f13f1c02858ae1c38d443
SHA256

c75197d845097c3449a4ba4ec8480ae2ba5009949c4727363ef7627f50983f29
SHA512

0698dbbaf439575776dbd4675bd0b54e187bf87e89a0190db4e7b4ed65687d01f4814d55609831dffc967ed4c7392d0786fe749afc2b0fbcf9f613df77cd6ff1
SSDEEP

1536:JYV33vPzLaLePtYLVNG3vAGDO1Tn5wEKijQfQ06LOg6c/:+Vv3GLCVD+ZKijozoOzc/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 896	816	regsvr32.exe	28
PID 816 wrote to memory of 896	816	regsvr32.exe	28
PID 816 wrote to memory of 896	816	regsvr32.exe	28
PID 816 wrote to memory of 896	816	regsvr32.exe	28
PID 816 wrote to memory of 896	816	regsvr32.exe	28
PID 816 wrote to memory of 896	816	regsvr32.exe	28
PID 816 wrote to memory of 896	816	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c75197d845097c3449a4ba4ec8480ae2ba5009949c4727363ef7627f50983f29.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c75197d845097c3449a4ba4ec8480ae2ba5009949c4727363ef7627f50983f29.dll
  2⤵
  PID:896

memory/816-54-0x000007FEFC581000-0x000007FEFC583000-memory.dmp

Filesize
8KB

Download
memory/896-56-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download