4bb005439023b65532fe60d2d5ab5d67a7cd7edb19914ec9dce10851cb0184cd

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 21:25

Target

4bb005439023b65532fe60d2d5ab5d67a7cd7edb19914ec9dce10851cb0184cd.dll
Size

120KB
MD5

e14eadec410cf1a1138780e848c171d0
SHA1

0164fab3e6690e6d4fb7e9da9d267b7abb40cb52
SHA256

4bb005439023b65532fe60d2d5ab5d67a7cd7edb19914ec9dce10851cb0184cd
SHA512

ca96e770458d56b9aac9e7045b1b539489a5edf3d4032bb1984c72069115bcd38f8e91ba78c58fa5bc7bf1077c263b139aba785587853d461e06f52cf5a56147
SSDEEP

1536:K+qCQmOszcIoWkwKnlAlv4Jpo0WZdozv/rEpncOOY:l3OeoyH2gnsgcOt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27
PID 1048 wrote to memory of 1388	1048	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4bb005439023b65532fe60d2d5ab5d67a7cd7edb19914ec9dce10851cb0184cd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4bb005439023b65532fe60d2d5ab5d67a7cd7edb19914ec9dce10851cb0184cd.dll
  2⤵
  PID:1388

memory/1048-54-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download
memory/1388-56-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1388-57-0x0000000000220000-0x000000000023E000-memory.dmp

Filesize
120KB

Download