a16f73bb2c26801bdcadfc6d5a60911799d3adea6ca700bed13db2059d5f0010

Analysis

max time kernel
37s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 10:32

Target

a16f73bb2c26801bdcadfc6d5a60911799d3adea6ca700bed13db2059d5f0010.dll
Size

222KB
MD5

c727e83383f1ca1fc5c42a24050477b1
SHA1

742e86ed5520eae932fbb9fa51c02b699587efde
SHA256

a16f73bb2c26801bdcadfc6d5a60911799d3adea6ca700bed13db2059d5f0010
SHA512

0ac9578c6a176ad3dbe9da47e5643591e3e409b100a0b00b2795b182ef6a1d99b204ac4ac9ff5c99f648869c48368daaa0c67f034a60b744772a0f5e2d4f73d6
SSDEEP

3072:lYdtJXvQHC2y826eL/uVZxOEnYmBeWBvGVQBPSgIuAkBa:cYHzy8pCvm7BvNq2xBa

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 268 wrote to memory of 692	268	regsvr32.exe	28
PID 268 wrote to memory of 692	268	regsvr32.exe	28
PID 268 wrote to memory of 692	268	regsvr32.exe	28
PID 268 wrote to memory of 692	268	regsvr32.exe	28
PID 268 wrote to memory of 692	268	regsvr32.exe	28
PID 268 wrote to memory of 692	268	regsvr32.exe	28
PID 268 wrote to memory of 692	268	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a16f73bb2c26801bdcadfc6d5a60911799d3adea6ca700bed13db2059d5f0010.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:268
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a16f73bb2c26801bdcadfc6d5a60911799d3adea6ca700bed13db2059d5f0010.dll
  2⤵
  PID:692

memory/268-54-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

Filesize
8KB

Download
memory/692-56-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download