d07cb442f1b95b159e93dcecf8049b777e6bd06926fdfd2b8e795f845c5b070d

Analysis

max time kernel
222s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 21:16

Target

d07cb442f1b95b159e93dcecf8049b777e6bd06926fdfd2b8e795f845c5b070d.dll
Size

23KB
MD5

d08f49fb068433e8cfc6e8bbd6b578e8
SHA1

6f916a64bd85b1e48a0878bbadadac88f2166d23
SHA256

d07cb442f1b95b159e93dcecf8049b777e6bd06926fdfd2b8e795f845c5b070d
SHA512

4cca01cef692464dd7fd386246d949b331c831747dd97d7a71a653fad0075ea17583609caacbf2fde7f3169656d9b0a698749b1e7db214179738cd19bc621e43
SSDEEP

384:XO9xz0CX0pqd+1ijQmZzdxVa3omF+3wbtP6iYwOmm7wdDAzBKmktc:+cCXEqdSQQS7SIgXYijdsBt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 888	1712	regsvr32.exe	27
PID 1712 wrote to memory of 888	1712	regsvr32.exe	27
PID 1712 wrote to memory of 888	1712	regsvr32.exe	27
PID 1712 wrote to memory of 888	1712	regsvr32.exe	27
PID 1712 wrote to memory of 888	1712	regsvr32.exe	27
PID 1712 wrote to memory of 888	1712	regsvr32.exe	27
PID 1712 wrote to memory of 888	1712	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d07cb442f1b95b159e93dcecf8049b777e6bd06926fdfd2b8e795f845c5b070d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d07cb442f1b95b159e93dcecf8049b777e6bd06926fdfd2b8e795f845c5b070d.dll
  2⤵
  PID:888

memory/888-55-0x0000000000000000-mapping.dmp

Download
memory/888-56-0x0000000076D71000-0x0000000076D73000-memory.dmp

Filesize
8KB

Download
memory/1712-54-0x000007FEFC461000-0x000007FEFC463000-memory.dmp

Filesize
8KB

Download