bd93837807d81a2434269fe6f145f91281366e559484f07dc548774c1cab8436

Analysis

max time kernel
35s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 03:15

Target

bd93837807d81a2434269fe6f145f91281366e559484f07dc548774c1cab8436.dll
Size

91KB
MD5

c1d8276cb483d19b9ec1dd01887db21f
SHA1

bd4cc1defdc0788cfcb8256a93658fa5e155f8a7
SHA256

bd93837807d81a2434269fe6f145f91281366e559484f07dc548774c1cab8436
SHA512

2beb9229bfa03f6f42a9780d99c8dc65d044c59cc63ef42d4c9de813debd37d7e27448d2ab29c4c829414d14d26992bee42365ebff00c0ec65ef476126909bd3
SSDEEP

1536:vGl9JtL3YwBx0UimNQv8uh+YyBx1+wX2m785UQojfhJh1bHskytDWtzAujdlQvS:vGzJ53YPmNu+Y6G5y7fbp0yRjdlp

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 896	752	regsvr32.exe	27
PID 752 wrote to memory of 896	752	regsvr32.exe	27
PID 752 wrote to memory of 896	752	regsvr32.exe	27
PID 752 wrote to memory of 896	752	regsvr32.exe	27
PID 752 wrote to memory of 896	752	regsvr32.exe	27
PID 752 wrote to memory of 896	752	regsvr32.exe	27
PID 752 wrote to memory of 896	752	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bd93837807d81a2434269fe6f145f91281366e559484f07dc548774c1cab8436.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bd93837807d81a2434269fe6f145f91281366e559484f07dc548774c1cab8436.dll
  2⤵
  PID:896

memory/752-54-0x000007FEFC161000-0x000007FEFC163000-memory.dmp

Filesize
8KB

Download
memory/896-56-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download