ac53ad7f5aa51958f6b2177271a7cc32e6d6ab60c7a4d344b4c5c00244db036e

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 13:23

Target

ac53ad7f5aa51958f6b2177271a7cc32e6d6ab60c7a4d344b4c5c00244db036e.dll
Size

196KB
MD5

62b0a37ed6dc8ea1ed607c384f8dbabb
SHA1

48b300b448f43572e1bbbca44aa98bb210fb6aa1
SHA256

ac53ad7f5aa51958f6b2177271a7cc32e6d6ab60c7a4d344b4c5c00244db036e
SHA512

111c8958b2d2f16040c810eabf238dceb172e753054b1966000cbac6fb3afeb83d5d55239ee36ccbbe9673b9a9a2e83a002f513946caae66f087411788c37843
SSDEEP

6144:jYJ4S0Qmn675xHu5nsMJqS/Mmc0TkkRsknTVD:G4S0Qmn675xHu5C+M075R

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1516	1456	regsvr32.exe	26
PID 1456 wrote to memory of 1516	1456	regsvr32.exe	26
PID 1456 wrote to memory of 1516	1456	regsvr32.exe	26
PID 1456 wrote to memory of 1516	1456	regsvr32.exe	26
PID 1456 wrote to memory of 1516	1456	regsvr32.exe	26
PID 1456 wrote to memory of 1516	1456	regsvr32.exe	26
PID 1456 wrote to memory of 1516	1456	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ac53ad7f5aa51958f6b2177271a7cc32e6d6ab60c7a4d344b4c5c00244db036e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ac53ad7f5aa51958f6b2177271a7cc32e6d6ab60c7a4d344b4c5c00244db036e.dll
  2⤵
  PID:1516

memory/1456-54-0x000007FEFB5E1000-0x000007FEFB5E3000-memory.dmp

Filesize
8KB

Download
memory/1516-56-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download