72ebe5d76fe31eb584cf70aa1d4103fffe2054fd7e2783aca1cf76d54ab38bf0

Analysis

max time kernel
30s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 01:14

Target

72ebe5d76fe31eb584cf70aa1d4103fffe2054fd7e2783aca1cf76d54ab38bf0.dll
Size

432KB
MD5

ce881f75058bb8bc2acd853569838350
SHA1

f1b189e2b16d54b7423af52209f95e8cedc73b41
SHA256

72ebe5d76fe31eb584cf70aa1d4103fffe2054fd7e2783aca1cf76d54ab38bf0
SHA512

e1113f4f4a73654f71ed4f2abfc6815471e44ef3916a203f6a768bdf6a25314c3d8640945fa95fdaeb6dc2db96ef4d75ae5b8cec4454290ec0d6d8725af82c01
SSDEEP

6144:3CnJtKFKgoMvnE1P6/pofRWq+m0zyx3h6l66x4zcKgHh8iyI1kd:3Y6Z/yJInqix32iyI

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2016	1340	regsvr32.exe	28
PID 1340 wrote to memory of 2016	1340	regsvr32.exe	28
PID 1340 wrote to memory of 2016	1340	regsvr32.exe	28
PID 1340 wrote to memory of 2016	1340	regsvr32.exe	28
PID 1340 wrote to memory of 2016	1340	regsvr32.exe	28
PID 1340 wrote to memory of 2016	1340	regsvr32.exe	28
PID 1340 wrote to memory of 2016	1340	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\72ebe5d76fe31eb584cf70aa1d4103fffe2054fd7e2783aca1cf76d54ab38bf0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\72ebe5d76fe31eb584cf70aa1d4103fffe2054fd7e2783aca1cf76d54ab38bf0.dll
  2⤵
  PID:2016

memory/1340-54-0x000007FEFBFE1000-0x000007FEFBFE3000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/2016-57-0x00000000667F0000-0x000000006685E000-memory.dmp

Filesize
440KB

Download
memory/2016-58-0x0000000000190000-0x0000000000194000-memory.dmp

Filesize
16KB

Download
memory/2016-59-0x00000000667F0000-0x000000006685E000-memory.dmp

Filesize
440KB

Download
memory/2016-60-0x0000000000160000-0x0000000000184000-memory.dmp

Filesize
144KB

Download