ef620719552a3169fe4f5e2fd038021a9c162d7ca408061aa700b193c4b499e6

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 17:33

Target

ef620719552a3169fe4f5e2fd038021a9c162d7ca408061aa700b193c4b499e6.dll
Size

630KB
MD5

9015e8cd2f1b2705446ddae2d1889c1a
SHA1

eb778772bdc628858f96a3754053577fed9961a1
SHA256

ef620719552a3169fe4f5e2fd038021a9c162d7ca408061aa700b193c4b499e6
SHA512

dd796cb44ff4d9d3201a38addafab178befb8be778aa8720ab8923604699062c4ff183fc326f06a388e431c987ba144332f6ab8361b140810f0b81b22f26fe21
SSDEEP

12288:MD48aMMsKS9BAXjhkTMyWt4w/ui5WCLjNBNy:MUSMsL72qMS1EWajU

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1496	1788	regsvr32.exe	27
PID 1788 wrote to memory of 1496	1788	regsvr32.exe	27
PID 1788 wrote to memory of 1496	1788	regsvr32.exe	27
PID 1788 wrote to memory of 1496	1788	regsvr32.exe	27
PID 1788 wrote to memory of 1496	1788	regsvr32.exe	27
PID 1788 wrote to memory of 1496	1788	regsvr32.exe	27
PID 1788 wrote to memory of 1496	1788	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ef620719552a3169fe4f5e2fd038021a9c162d7ca408061aa700b193c4b499e6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ef620719552a3169fe4f5e2fd038021a9c162d7ca408061aa700b193c4b499e6.dll
  2⤵
  PID:1496

memory/1496-56-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1788-54-0x000007FEFBF41000-0x000007FEFBF43000-memory.dmp

Filesize
8KB

Download