eea28a5dc718043314109bd2dcc083c2d4d46d82e92b4f7e657f1131c8497641

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 21:15

Target

eea28a5dc718043314109bd2dcc083c2d4d46d82e92b4f7e657f1131c8497641.dll
Size

788KB
MD5

60903297667d71f88fb1cc337c5ffc8f
SHA1

8dd6d9e618a6cec19d06394c633a733a52e436d7
SHA256

eea28a5dc718043314109bd2dcc083c2d4d46d82e92b4f7e657f1131c8497641
SHA512

a1a3e324c30a4d9d38cf2c7cd11d86587902b4905f11c06b7631899317414028b31a41db67b43294c8d85d62ffe5066a2799d4b1a356589c334cef7d4a0c84b4
SSDEEP

12288:aKJGD91Y+oskxcegrSeRfglwxr+OhlKDlrgH8QkkQi:aGGjYX7crFgLOhMJrefk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1620	1612	regsvr32.exe	26
PID 1612 wrote to memory of 1620	1612	regsvr32.exe	26
PID 1612 wrote to memory of 1620	1612	regsvr32.exe	26
PID 1612 wrote to memory of 1620	1612	regsvr32.exe	26
PID 1612 wrote to memory of 1620	1612	regsvr32.exe	26
PID 1612 wrote to memory of 1620	1612	regsvr32.exe	26
PID 1612 wrote to memory of 1620	1612	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\eea28a5dc718043314109bd2dcc083c2d4d46d82e92b4f7e657f1131c8497641.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\eea28a5dc718043314109bd2dcc083c2d4d46d82e92b4f7e657f1131c8497641.dll
  2⤵
  PID:1620

memory/1612-54-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

Filesize
8KB

Download
memory/1620-56-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download