d82e77e365b2f2932873156835a560524aeb4dca71569a6d93254ecbba529afb

Analysis

max time kernel
24s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 13:36

Target

d82e77e365b2f2932873156835a560524aeb4dca71569a6d93254ecbba529afb.dll
Size

276KB
MD5

f7fa40353dc26ef6ab41e3bdc3fb960d
SHA1

c1c9c8746e4d8306d99372b3d90119a213bf831e
SHA256

d82e77e365b2f2932873156835a560524aeb4dca71569a6d93254ecbba529afb
SHA512

d5210971e67ec33e90a8a792f4eea4c3f7ab852b6e8b25d8ea67b9c10b77c249a9f54af3e497925108dde05b5fd6589baad7a8c9b68dd742163936dc58bd94e8
SSDEEP

6144:7EmSpAuZ4RWJYn8tED0weBYMgl3lMu1k7:7EmOAuZXWnCEiBYMgll1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28
PID 1008 wrote to memory of 1672	1008	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d82e77e365b2f2932873156835a560524aeb4dca71569a6d93254ecbba529afb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d82e77e365b2f2932873156835a560524aeb4dca71569a6d93254ecbba529afb.dll
  2⤵
  PID:1672

memory/1008-54-0x000007FEFB901000-0x000007FEFB903000-memory.dmp

Filesize
8KB

Download
memory/1672-56-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download