c85d14e1a6afa43d497ab3ef6b0038247709743229d932e248c346f1b678e3c1

Analysis

max time kernel
38s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 05:09 UTC

Target

c85d14e1a6afa43d497ab3ef6b0038247709743229d932e248c346f1b678e3c1.dll
Size

588KB
MD5

bf292c4b8733fcec3e13afd8d9388fc0
SHA1

fd47c5708cfa5cc82860e674dc08c0b07699bc65
SHA256

c85d14e1a6afa43d497ab3ef6b0038247709743229d932e248c346f1b678e3c1
SHA512

bf21677fa6a5dd6d30847f2f4a03fe025315741120d76f03421ecffb3c1b649cb2b1756fb9e49f55e0a42bfa0622d79da90b7abab5f6c641adf5103468ee5899
SSDEEP

768:KS8e81YY2uXZ9hAVawuStKIZ+2fJcwqVETAz4HMBbsjjRGPZMoFpV:c6Y2IGe7IZ+nVETAzFs1foF3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1208	1764	regsvr32.exe	28
PID 1764 wrote to memory of 1208	1764	regsvr32.exe	28
PID 1764 wrote to memory of 1208	1764	regsvr32.exe	28
PID 1764 wrote to memory of 1208	1764	regsvr32.exe	28
PID 1764 wrote to memory of 1208	1764	regsvr32.exe	28
PID 1764 wrote to memory of 1208	1764	regsvr32.exe	28
PID 1764 wrote to memory of 1208	1764	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c85d14e1a6afa43d497ab3ef6b0038247709743229d932e248c346f1b678e3c1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c85d14e1a6afa43d497ab3ef6b0038247709743229d932e248c346f1b678e3c1.dll
  2⤵
  PID:1208

memory/1208-56-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1764-54-0x000007FEFC0D1000-0x000007FEFC0D3000-memory.dmp

Filesize
8KB

Download