a9ddb6254e8deb40281788e8f8b0d5d74e5eeb4427058b07d2c425647faf8c79

Analysis

max time kernel
16s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 01:46

Target

a9ddb6254e8deb40281788e8f8b0d5d74e5eeb4427058b07d2c425647faf8c79.dll
Size

84KB
MD5

e3f5ba53cb106a00702b5d92ba8119f1
SHA1

9f2711b6bcd8a42caee94dafe9298a9d3a57e6ab
SHA256

a9ddb6254e8deb40281788e8f8b0d5d74e5eeb4427058b07d2c425647faf8c79
SHA512

862eb1894a196be695f69eb8eafc1bb342ca868e0d355bf0d361263e5c49f9c0ef824fe50b729271b3a38a63784cd6941184ae7ecdd5816b38c588d84de24402
SSDEEP

1536:hjRv/Hh+d6WHflaNPxPnCr73U/zc2UoR8EGszapcSf9:htvvod6gfAPVnCrDUrt/PQ9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 368	1928	regsvr32.exe	27
PID 1928 wrote to memory of 368	1928	regsvr32.exe	27
PID 1928 wrote to memory of 368	1928	regsvr32.exe	27
PID 1928 wrote to memory of 368	1928	regsvr32.exe	27
PID 1928 wrote to memory of 368	1928	regsvr32.exe	27
PID 1928 wrote to memory of 368	1928	regsvr32.exe	27
PID 1928 wrote to memory of 368	1928	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a9ddb6254e8deb40281788e8f8b0d5d74e5eeb4427058b07d2c425647faf8c79.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a9ddb6254e8deb40281788e8f8b0d5d74e5eeb4427058b07d2c425647faf8c79.dll
  2⤵
  PID:368

memory/368-55-0x0000000000000000-mapping.dmp

Download
memory/368-56-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download
memory/1928-54-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Filesize
8KB

Download