9e1ae35ac7a7e4b148b1e56c26d35c8608fb441cd9f25ad99ecd8d26c78778e1

Analysis

max time kernel
45s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 11:23

Target

9e1ae35ac7a7e4b148b1e56c26d35c8608fb441cd9f25ad99ecd8d26c78778e1.dll
Size

144KB
MD5

c27e0ed667f04c540f47feae2587c0b0
SHA1

a91e2d8927fb83203c3dc710be1b2cd0068b666a
SHA256

9e1ae35ac7a7e4b148b1e56c26d35c8608fb441cd9f25ad99ecd8d26c78778e1
SHA512

52ad7f47ebceb853d26c2775e5b0cbd79252b3af205c7443e3691486adf20b58cb6300d6a1082158c72df82147595537c9dae98dce2bbfc6e7be7b7844b38df2
SSDEEP

3072:qzNn/yTZtVv8mexZpYSxvv7romYJ4nyBqmssuxSxfOcGuZ:qzN/qV0pNzrCssux8fW2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1252	1744	regsvr32.exe	27
PID 1744 wrote to memory of 1252	1744	regsvr32.exe	27
PID 1744 wrote to memory of 1252	1744	regsvr32.exe	27
PID 1744 wrote to memory of 1252	1744	regsvr32.exe	27
PID 1744 wrote to memory of 1252	1744	regsvr32.exe	27
PID 1744 wrote to memory of 1252	1744	regsvr32.exe	27
PID 1744 wrote to memory of 1252	1744	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9e1ae35ac7a7e4b148b1e56c26d35c8608fb441cd9f25ad99ecd8d26c78778e1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9e1ae35ac7a7e4b148b1e56c26d35c8608fb441cd9f25ad99ecd8d26c78778e1.dll
  2⤵
  PID:1252

memory/1252-56-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1744-54-0x000007FEFB651000-0x000007FEFB653000-memory.dmp

Filesize
8KB

Download