bee721f7b26fa745c0ef5b90e93f97885b47d3a686c9a64344a556b95b416b89

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 14:03

Target

bee721f7b26fa745c0ef5b90e93f97885b47d3a686c9a64344a556b95b416b89.dll
Size

128KB
MD5

73630d39d484772cbe935b794515fef5
SHA1

66f371b82865547dde216bf1dcb4f07e6b05b9d6
SHA256

bee721f7b26fa745c0ef5b90e93f97885b47d3a686c9a64344a556b95b416b89
SHA512

f86b43635ed7a34394fba20854e21da0522488ec27df5be0e87911bc8d20a9aebd3d1612d0d56250ee79b73a2b2c0c3276d2a29e12163d0619b9fdde2af324ef
SSDEEP

1536:+UgJ+b3g2rWyvmULwsQqdnITBNQIZnCLzsBA6:+arWyv7wc8iItCLzsBH

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1128	2016	regsvr32.exe	26
PID 2016 wrote to memory of 1128	2016	regsvr32.exe	26
PID 2016 wrote to memory of 1128	2016	regsvr32.exe	26
PID 2016 wrote to memory of 1128	2016	regsvr32.exe	26
PID 2016 wrote to memory of 1128	2016	regsvr32.exe	26
PID 2016 wrote to memory of 1128	2016	regsvr32.exe	26
PID 2016 wrote to memory of 1128	2016	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bee721f7b26fa745c0ef5b90e93f97885b47d3a686c9a64344a556b95b416b89.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bee721f7b26fa745c0ef5b90e93f97885b47d3a686c9a64344a556b95b416b89.dll
  2⤵
  PID:1128

memory/1128-56-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2016-54-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

Filesize
8KB

Download