b4144af4ca64c79357f991551647bbf30bb4bfb335a36002b32c351fcc09e8d1

Analysis

max time kernel
19s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 07:00

Target

b4144af4ca64c79357f991551647bbf30bb4bfb335a36002b32c351fcc09e8d1.dll
Size

225KB
MD5

cabea55f813088bddddcc66c2986f671
SHA1

2f4af81763a693119cd3d36676c5703f97254a3d
SHA256

b4144af4ca64c79357f991551647bbf30bb4bfb335a36002b32c351fcc09e8d1
SHA512

9835c164c82f024f06191792276efda80218805894563a48cbf8c68fb0e19240a7300fe213b6260de50ab64ee2af136f3a706545eb288f063a23b5d19c7a1cfe
SSDEEP

3072:vw6Nke6gu8U0kDw+PNXRbzWyGrj6JhKv8TEgY2zZAJ0tEpgtg9HguPt+AFqnPJ86:o6Nke5UdNXRbCfnohBTY2VGpgtw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 1892	980	regsvr32.exe	28
PID 980 wrote to memory of 1892	980	regsvr32.exe	28
PID 980 wrote to memory of 1892	980	regsvr32.exe	28
PID 980 wrote to memory of 1892	980	regsvr32.exe	28
PID 980 wrote to memory of 1892	980	regsvr32.exe	28
PID 980 wrote to memory of 1892	980	regsvr32.exe	28
PID 980 wrote to memory of 1892	980	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b4144af4ca64c79357f991551647bbf30bb4bfb335a36002b32c351fcc09e8d1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b4144af4ca64c79357f991551647bbf30bb4bfb335a36002b32c351fcc09e8d1.dll
  2⤵
  PID:1892

memory/980-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download
memory/1892-56-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download