ae5de6e52db040faa414a00fb5db0322a429f79bb2b41f5179319a6ecae4965d

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 09:04

Target

ae5de6e52db040faa414a00fb5db0322a429f79bb2b41f5179319a6ecae4965d.dll
Size

126KB
MD5

dbbe57f470051316a1ac8920f4415a1f
SHA1

7c8827496bd703f145a3e9264561293779171f87
SHA256

ae5de6e52db040faa414a00fb5db0322a429f79bb2b41f5179319a6ecae4965d
SHA512

9c7f9ded61b7754249ebad1cca83d0f114045be75b42041f507fe2d2617ddb0e9feca80a5ffdae4a54ace988c6b5c46f52a97e99cfefc9413b0218ea991e2012
SSDEEP

1536:okfYJXxx8LkfYJXxx8LkfYJXxx8LkfYJXxx8:MF38lF38lF38lF38

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 1944	1784	regsvr32.exe	28
PID 1784 wrote to memory of 1944	1784	regsvr32.exe	28
PID 1784 wrote to memory of 1944	1784	regsvr32.exe	28
PID 1784 wrote to memory of 1944	1784	regsvr32.exe	28
PID 1784 wrote to memory of 1944	1784	regsvr32.exe	28
PID 1784 wrote to memory of 1944	1784	regsvr32.exe	28
PID 1784 wrote to memory of 1944	1784	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ae5de6e52db040faa414a00fb5db0322a429f79bb2b41f5179319a6ecae4965d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ae5de6e52db040faa414a00fb5db0322a429f79bb2b41f5179319a6ecae4965d.dll
  2⤵
  PID:1944

memory/1784-54-0x000007FEFBA01000-0x000007FEFBA03000-memory.dmp

Filesize
8KB

Download
memory/1944-56-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download