b40be094696c60e586d8ab1d726578bf04ff8d96d4d1cb0b0e14a2d95c263fcd

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 16:46

Target

b40be094696c60e586d8ab1d726578bf04ff8d96d4d1cb0b0e14a2d95c263fcd.dll
Size

38KB
MD5

4fcdf23624624484cffdd3d7e852a2f3
SHA1

0f8c990ea73218dd51aab0da67e3d3b1b48dd6e6
SHA256

b40be094696c60e586d8ab1d726578bf04ff8d96d4d1cb0b0e14a2d95c263fcd
SHA512

3459bad891002a99c5a6b8cca87582e78ba0f1d7cb9f7ff1a2b638fded7bfd6ec5fe499ff4d71a8c1d3de3af5e0dbe2100827a9646ec3efff46fcd3a5adf9206
SSDEEP

768:uTERvKYRgrpRqt6LuSBQ6qRD549AFlgsQAygevZL:FKsgFRqtAuS66q/49AwsQAygevZL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1228	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1228	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1228	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1228	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1228	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1228	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1228	1204	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b40be094696c60e586d8ab1d726578bf04ff8d96d4d1cb0b0e14a2d95c263fcd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b40be094696c60e586d8ab1d726578bf04ff8d96d4d1cb0b0e14a2d95c263fcd.dll
  2⤵
  PID:1228

memory/1204-54-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download
memory/1228-56-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download