e554c1db1c33cd2086860d62a17c4c987248789b865cd7eaffd4903a8b7a404b

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 03:26

Target

e554c1db1c33cd2086860d62a17c4c987248789b865cd7eaffd4903a8b7a404b.dll
Size

132KB
MD5

773cc50bd26d6bd29350fbc2167ec580
SHA1

1de5452beb125786b7dd82fce403f93c909249d6
SHA256

e554c1db1c33cd2086860d62a17c4c987248789b865cd7eaffd4903a8b7a404b
SHA512

666cc1430cb8ba02de448409ca192650b148e9cf3210812b826ee6985ca87fee46da680a6253b57df08936964484e1a143b93186046c7b2b626617ed769c0243
SSDEEP

1536:YFMqXvbQcf8rNRmfq/8AHJpUaESg45xJSEhCg:oXDeuq5c65xJSEEg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 684	1584	regsvr32.exe	28
PID 1584 wrote to memory of 684	1584	regsvr32.exe	28
PID 1584 wrote to memory of 684	1584	regsvr32.exe	28
PID 1584 wrote to memory of 684	1584	regsvr32.exe	28
PID 1584 wrote to memory of 684	1584	regsvr32.exe	28
PID 1584 wrote to memory of 684	1584	regsvr32.exe	28
PID 1584 wrote to memory of 684	1584	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e554c1db1c33cd2086860d62a17c4c987248789b865cd7eaffd4903a8b7a404b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e554c1db1c33cd2086860d62a17c4c987248789b865cd7eaffd4903a8b7a404b.dll
  2⤵
  PID:684

memory/684-56-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download
memory/1584-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Filesize
8KB

Download