cd2a21ee263462041bb592152b381d6b282521e0374dc1bd42ba5ef11a93d913

Analysis

max time kernel
38s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 05:34

Target

cd2a21ee263462041bb592152b381d6b282521e0374dc1bd42ba5ef11a93d913.dll
Size

156KB
MD5

59e5807b4a00352547aa6bc32409f423
SHA1

0e59343241077a80922cca81bba9b6f572bc2aca
SHA256

cd2a21ee263462041bb592152b381d6b282521e0374dc1bd42ba5ef11a93d913
SHA512

71fbd2a5daf5a20020b8e976448cf93417ca5dcbd0efff84e29cf0dccd1da89d481aca433960ba2bb82f04387ea365f6308d9c06c9377efb489c1f3acbe31694
SSDEEP

1536:PB+FpymXELWsmKVy2ipO8MPzZqsTpoQPYSV2KHW9apVrICS4ASilQogLae0XiK:Z+X3XEi+SyqVzVAeQozZX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1664	960	regsvr32.exe	28
PID 960 wrote to memory of 1664	960	regsvr32.exe	28
PID 960 wrote to memory of 1664	960	regsvr32.exe	28
PID 960 wrote to memory of 1664	960	regsvr32.exe	28
PID 960 wrote to memory of 1664	960	regsvr32.exe	28
PID 960 wrote to memory of 1664	960	regsvr32.exe	28
PID 960 wrote to memory of 1664	960	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cd2a21ee263462041bb592152b381d6b282521e0374dc1bd42ba5ef11a93d913.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cd2a21ee263462041bb592152b381d6b282521e0374dc1bd42ba5ef11a93d913.dll
  2⤵
  PID:1664

memory/960-54-0x000007FEFBA41000-0x000007FEFBA43000-memory.dmp

Filesize
8KB

Download
memory/1664-56-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download