9b59235a987cfb3242462e4e6cfa05c241fbf93de2cb35c72708da9ba23303cf

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 17:42

Target

9b59235a987cfb3242462e4e6cfa05c241fbf93de2cb35c72708da9ba23303cf.dll
Size

572KB
MD5

401b40c6057ca94534f4945dfad3c36b
SHA1

84239e89e03a963046ed165c2d8291614ea65a2a
SHA256

9b59235a987cfb3242462e4e6cfa05c241fbf93de2cb35c72708da9ba23303cf
SHA512

6488047272bc1e1f5addc55498e71575e6c61cd5e6c0b4cb90092416f1868715e482ca668d743c085212bc6bf9ef1938bc41ee46a5c9bac110447b8aec8d9629
SSDEEP

12288:IZa4BeZGpmJ1aDuV+77hrARPhvKJwsAMF39Ib8rozbLCqw:IgsejTXY77i3vXMFSb8vj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1580	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1580	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1580	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1580	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1580	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1580	1672	regsvr32.exe	27
PID 1672 wrote to memory of 1580	1672	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9b59235a987cfb3242462e4e6cfa05c241fbf93de2cb35c72708da9ba23303cf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9b59235a987cfb3242462e4e6cfa05c241fbf93de2cb35c72708da9ba23303cf.dll
  2⤵
  PID:1580

memory/1580-56-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/1672-54-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

Filesize
8KB

Download