a38083f40aa0246d649233c2bdc038ff448598505edf31ada2bb7ff4e36f798c

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 10:19

Target

a38083f40aa0246d649233c2bdc038ff448598505edf31ada2bb7ff4e36f798c.dll
Size

588KB
MD5

76ac1323f2f40d8189624835f014bf34
SHA1

5b50e334b33c5589d9e2426b8cb15766cca8f59b
SHA256

a38083f40aa0246d649233c2bdc038ff448598505edf31ada2bb7ff4e36f798c
SHA512

7174edb5b03f1855c3e8a6daec1029c2b518809694db931223edcd63bf7698579d8dc9707418d0a8f486e101a67dc5942ee7fcd1e1e1c3cb581fadf73b829544
SSDEEP

1536:CnUge63TC2tOmXbJVaK3R0XMJ33iU5hVXl7NeLZ61due6moMNNlltdgHXTzHrz08:QjTOubqoNNfob

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2000	1992	regsvr32.exe	26
PID 1992 wrote to memory of 2000	1992	regsvr32.exe	26
PID 1992 wrote to memory of 2000	1992	regsvr32.exe	26
PID 1992 wrote to memory of 2000	1992	regsvr32.exe	26
PID 1992 wrote to memory of 2000	1992	regsvr32.exe	26
PID 1992 wrote to memory of 2000	1992	regsvr32.exe	26
PID 1992 wrote to memory of 2000	1992	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a38083f40aa0246d649233c2bdc038ff448598505edf31ada2bb7ff4e36f798c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a38083f40aa0246d649233c2bdc038ff448598505edf31ada2bb7ff4e36f798c.dll
  2⤵
  PID:2000

memory/1992-54-0x000007FEFBE81000-0x000007FEFBE83000-memory.dmp

Filesize
8KB

Download
memory/2000-56-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download