b60840cda47483f38e580b79c6a1997541362d57ef50136f39a650099056b9b2

Analysis

max time kernel
7s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 08:11

Target

b60840cda47483f38e580b79c6a1997541362d57ef50136f39a650099056b9b2.dll
Size

128KB
MD5

1649fa30382df30084a70341a6f45ff0
SHA1

2e8f576712b518ac2ded18c0abe0f7307db719b2
SHA256

b60840cda47483f38e580b79c6a1997541362d57ef50136f39a650099056b9b2
SHA512

639ecac990db3a0388cbbb1f0467cf92c26a7b3fe66f5fe41729045e40cc2a7d0d8ed683be56e728033f155eb9e76c399c7c4ba7cb486430854f9cbc68a10535
SSDEEP

1536:ZDfR/ro2LeV/dFPzmqiTyaDLhYETtyGqgo+XossFmu1k6:ZhrDeV/rPz7oqHGDo+XossUu1k6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1764	1952	regsvr32.exe	28
PID 1952 wrote to memory of 1764	1952	regsvr32.exe	28
PID 1952 wrote to memory of 1764	1952	regsvr32.exe	28
PID 1952 wrote to memory of 1764	1952	regsvr32.exe	28
PID 1952 wrote to memory of 1764	1952	regsvr32.exe	28
PID 1952 wrote to memory of 1764	1952	regsvr32.exe	28
PID 1952 wrote to memory of 1764	1952	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b60840cda47483f38e580b79c6a1997541362d57ef50136f39a650099056b9b2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b60840cda47483f38e580b79c6a1997541362d57ef50136f39a650099056b9b2.dll
  2⤵
  PID:1764

memory/1764-55-0x0000000000000000-mapping.dmp

Download
memory/1764-56-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/1952-54-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Filesize
8KB

Download