1751c378e2b14bd6238c3189e13501d191c117fdfe65e4e0ea1cb5829cce2bb9

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 05:06

Target

1751c378e2b14bd6238c3189e13501d191c117fdfe65e4e0ea1cb5829cce2bb9.dll
Size

1.9MB
MD5

34ce16849cdb1cd10ea1f8d1525136d7
SHA1

99d88aa5b93c5ef46d3fd9f6be6ff6b4369a4916
SHA256

1751c378e2b14bd6238c3189e13501d191c117fdfe65e4e0ea1cb5829cce2bb9
SHA512

c0b286ac4e40ff77efe7ec25c5bea2068557d2b5ec7b5ce7c965eaa1f7a82c31a6d7e1a46c7d151e47c502ba4b070d93e48b919783fb4bd8c5d1fd47934f4719
SSDEEP

24576:CeSshda+Vu5jUrpJlYWkoMBjkmdmS4jCfk0DlPW9ZpsAtWQ2Lq3oWbSt:Ce7d/4S9TYho+kMiWB0ZpspLWb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 948 wrote to memory of 1488	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1488	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1488	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1488	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1488	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1488	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1488	948	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1751c378e2b14bd6238c3189e13501d191c117fdfe65e4e0ea1cb5829cce2bb9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1751c378e2b14bd6238c3189e13501d191c117fdfe65e4e0ea1cb5829cce2bb9.dll
2⤵
PID:1488

memory/948-54-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Filesize
8KB

Download
memory/1488-55-0x0000000000000000-mapping.dmp

Download
memory/1488-56-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download