f4a15d879615e86191c7ea698161194d3ab3af274ec9da00c39101916312d521

Analysis

max time kernel
33s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 02:48

Target

f4a15d879615e86191c7ea698161194d3ab3af274ec9da00c39101916312d521.exe
Size

333KB
MD5

7efa9ecb85bff39d6f25170bf909a507
SHA1

831b023beb5279ee36773747cc279f8fbb5ffe6e
SHA256

f4a15d879615e86191c7ea698161194d3ab3af274ec9da00c39101916312d521
SHA512

eb9655c73e4e66927bd62e55a577137fe3dd9056fa30752ea02ea28c86dd88b4d99f1fdd522d155e9a5789243b3432a4765b5bb90e4d8648ba3194a495019213
SSDEEP

6144:meNndXiUhC8k3H2eNLT1Q8RwNYGGmsKBdp9gubr0l9B5c3poS5PHbhoy9KLsQpi:meNdXiskWenHzrmsKBdp9gubr0l9B5cl

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 304 wrote to memory of 316	304	regsvr32.exe	27
PID 304 wrote to memory of 316	304	regsvr32.exe	27
PID 304 wrote to memory of 316	304	regsvr32.exe	27
PID 304 wrote to memory of 316	304	regsvr32.exe	27
PID 304 wrote to memory of 316	304	regsvr32.exe	27
PID 304 wrote to memory of 316	304	regsvr32.exe	27
PID 304 wrote to memory of 316	304	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f4a15d879615e86191c7ea698161194d3ab3af274ec9da00c39101916312d521.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:304
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f4a15d879615e86191c7ea698161194d3ab3af274ec9da00c39101916312d521.exe
  2⤵
  PID:316

memory/304-54-0x000007FEFBD81000-0x000007FEFBD83000-memory.dmp

Filesize
8KB

Download
memory/316-55-0x0000000000000000-mapping.dmp

Download
memory/316-56-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download