b6a5edd15ccddce0bff67cca4b441cda66c97441c365a4134f87dc6212874c43

Analysis

max time kernel
3s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 06:48

Target

b6a5edd15ccddce0bff67cca4b441cda66c97441c365a4134f87dc6212874c43.dll
Size

208KB
MD5

0b459ce42094a5210db40b38f84774f0
SHA1

4b754796395a8fd7d2151bb041e586936d2a6e65
SHA256

b6a5edd15ccddce0bff67cca4b441cda66c97441c365a4134f87dc6212874c43
SHA512

af7263a80f06405c1e0d9e6d68a098e3c2869ff7ed34ffa5b70d75d54dff20ea50e4c18a36d8dea25eae2404091e0458c435805292c0a9c12fb67b2fe1e23654
SSDEEP

1536:NE/D+zqWEaDaJuwqjqSYGhRiyfuky+k0wqjqSYGhRiyf0:/qWBOJEq5GTvuk7kyq5GTv0

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1768	1752	regsvr32.exe	28
PID 1752 wrote to memory of 1768	1752	regsvr32.exe	28
PID 1752 wrote to memory of 1768	1752	regsvr32.exe	28
PID 1752 wrote to memory of 1768	1752	regsvr32.exe	28
PID 1752 wrote to memory of 1768	1752	regsvr32.exe	28
PID 1752 wrote to memory of 1768	1752	regsvr32.exe	28
PID 1752 wrote to memory of 1768	1752	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b6a5edd15ccddce0bff67cca4b441cda66c97441c365a4134f87dc6212874c43.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b6a5edd15ccddce0bff67cca4b441cda66c97441c365a4134f87dc6212874c43.dll
  2⤵
  PID:1768

memory/1752-54-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmp

Filesize
8KB

Download
memory/1768-56-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download
memory/1768-57-0x0000000000170000-0x000000000017E000-memory.dmp

Filesize
56KB

Download