f126dfd6bbdbaf0b29cc569bfeaae87041bdc246251db7352b116ac27855ce4f

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 11:24

Target

f126dfd6bbdbaf0b29cc569bfeaae87041bdc246251db7352b116ac27855ce4f.dll
Size

588KB
MD5

e2dd1343afdd7d0f8930bce7feb65e0b
SHA1

5b3306e09cf2b7ef7c33923c9f10ad5a146e95c3
SHA256

f126dfd6bbdbaf0b29cc569bfeaae87041bdc246251db7352b116ac27855ce4f
SHA512

2e18a9fba2507417b0879910225e909694478750d260e5aa244d23c301f026ef726769dfbb63b618c81f37a50b9ae2a241a0d60ecb440e30a711ded177450f61
SSDEEP

768:7BRs43I9YY2uXZ9hAVa4mStKIZ+2fJcwqVETAz4HMBbsjjRGPZMo25CJV:vsYY2IGG7IZ+nVETAzFs1fo2wX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1104	2032	regsvr32.exe	26
PID 2032 wrote to memory of 1104	2032	regsvr32.exe	26
PID 2032 wrote to memory of 1104	2032	regsvr32.exe	26
PID 2032 wrote to memory of 1104	2032	regsvr32.exe	26
PID 2032 wrote to memory of 1104	2032	regsvr32.exe	26
PID 2032 wrote to memory of 1104	2032	regsvr32.exe	26
PID 2032 wrote to memory of 1104	2032	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f126dfd6bbdbaf0b29cc569bfeaae87041bdc246251db7352b116ac27855ce4f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f126dfd6bbdbaf0b29cc569bfeaae87041bdc246251db7352b116ac27855ce4f.dll
  2⤵
  PID:1104

memory/1104-56-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2032-54-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

Filesize
8KB

Download