abb1d8274537fec591e07d437c647f67f050b230c888e3946af2d4d4aa51552c

Analysis

max time kernel
24s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 04:31

Target

abb1d8274537fec591e07d437c647f67f050b230c888e3946af2d4d4aa51552c.dll
Size

128KB
MD5

7120a149c81451469600cca744dccec0
SHA1

c5263d692fe03df2f26f33a52c5e03dd1c7e3908
SHA256

abb1d8274537fec591e07d437c647f67f050b230c888e3946af2d4d4aa51552c
SHA512

e45def22c84cc017f5e3ff81a85f31479a16b314526612f229023c1c6b7dd1a50df35af654a2cdea0317af949c3161664348692027df1bc71ec15edf7da07ba9
SSDEEP

768:G2fCZqoQO8obQ0xJTK229keAdhrIohbtyN17a7XOOeWHCf3qKUihcoJHO9Udmnt:GrZqoQybQ6Thhr1bc17a3HA6BKr89UO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1912	1904	regsvr32.exe	27
PID 1904 wrote to memory of 1912	1904	regsvr32.exe	27
PID 1904 wrote to memory of 1912	1904	regsvr32.exe	27
PID 1904 wrote to memory of 1912	1904	regsvr32.exe	27
PID 1904 wrote to memory of 1912	1904	regsvr32.exe	27
PID 1904 wrote to memory of 1912	1904	regsvr32.exe	27
PID 1904 wrote to memory of 1912	1904	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\abb1d8274537fec591e07d437c647f67f050b230c888e3946af2d4d4aa51552c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\abb1d8274537fec591e07d437c647f67f050b230c888e3946af2d4d4aa51552c.dll
  2⤵
  PID:1912

memory/1904-54-0x000007FEFBB41000-0x000007FEFBB43000-memory.dmp

Filesize
8KB

Download
memory/1912-56-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download