f82750845b0abd85ee53e83da591da4252ff17fd92d06289f6e55c25a934c220

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 03:52

Target

f82750845b0abd85ee53e83da591da4252ff17fd92d06289f6e55c25a934c220.dll
Size

170KB
MD5

0691f60ce68b1a87b0eee4384dee29b2
SHA1

8f0052a3452a96db6ee028bfc664750ee572f9a4
SHA256

f82750845b0abd85ee53e83da591da4252ff17fd92d06289f6e55c25a934c220
SHA512

ae84f9dbab7393c484d250feb0842c64d778c865637adc135e4b9223486a174309ac588e05177822c1f34171a3f87dd1974cc21b1053488f261faacaefc5547f
SSDEEP

3072:eUXlFI6KJyss2qQwPyEKM3yCFWPusDBdR8ZdCzH/SxwsK1kN22B3szwk1:eMXI68yNqSx3yC8PVDBdRaCzH/Sxwn1D

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1984	1452	regsvr32.exe	26
PID 1452 wrote to memory of 1984	1452	regsvr32.exe	26
PID 1452 wrote to memory of 1984	1452	regsvr32.exe	26
PID 1452 wrote to memory of 1984	1452	regsvr32.exe	26
PID 1452 wrote to memory of 1984	1452	regsvr32.exe	26
PID 1452 wrote to memory of 1984	1452	regsvr32.exe	26
PID 1452 wrote to memory of 1984	1452	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f82750845b0abd85ee53e83da591da4252ff17fd92d06289f6e55c25a934c220.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f82750845b0abd85ee53e83da591da4252ff17fd92d06289f6e55c25a934c220.dll
  2⤵
  PID:1984

memory/1452-54-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp

Filesize
8KB

Download
memory/1984-56-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download