f826f6848b38bf1e15bc84f6b09160d63bc95eb424a488663627d6c4c59663e1

Analysis

max time kernel
224s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 01:34

Target

f826f6848b38bf1e15bc84f6b09160d63bc95eb424a488663627d6c4c59663e1.dll
Size

19KB
MD5

07175ea38dbe61b544eb3b25bd50c74e
SHA1

55e1850b9eeef0d24ecd163d9a246355730f2bb9
SHA256

f826f6848b38bf1e15bc84f6b09160d63bc95eb424a488663627d6c4c59663e1
SHA512

ab14f56632b6098b60ab080bbb4155d0566632efa85bab6abc2862d66a3759fa41d3467f5f63a7aa9429f370439f30ba1f67af8f58c55b48b6937926a1bfe6e8
SSDEEP

384:J1WWTEcW6Ucvf79e9LwUYuUd3uDnXywYU/nKngjmanUTdA:cYUcvUkRe6U/nKn2maUT+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 1536	568	regsvr32.exe	28
PID 568 wrote to memory of 1536	568	regsvr32.exe	28
PID 568 wrote to memory of 1536	568	regsvr32.exe	28
PID 568 wrote to memory of 1536	568	regsvr32.exe	28
PID 568 wrote to memory of 1536	568	regsvr32.exe	28
PID 568 wrote to memory of 1536	568	regsvr32.exe	28
PID 568 wrote to memory of 1536	568	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f826f6848b38bf1e15bc84f6b09160d63bc95eb424a488663627d6c4c59663e1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:568
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f826f6848b38bf1e15bc84f6b09160d63bc95eb424a488663627d6c4c59663e1.dll
  2⤵
  PID:1536

memory/568-54-0x000007FEFB641000-0x000007FEFB643000-memory.dmp

Filesize
8KB

Download
memory/1536-56-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download