f55797f046b1b04931b78bb085d18f620fab7a77472c7a571bebd10b1791304a

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/02/2023, 13:24

Target

358a93de3b50a306bd61ca0d61caf45fe2449f53.dll
Size

69KB
MD5

19be67e0356a3a292eaccbf41db640bb
SHA1

358a93de3b50a306bd61ca0d61caf45fe2449f53
SHA256

f55797f046b1b04931b78bb085d18f620fab7a77472c7a571bebd10b1791304a
SHA512

b927c2783d86850866a7b71410da8d8d326baa2ec945b471eadd95ea88fe3f5991ca239b0ee5cae48feca6ba6f26f336ac61f8cf7472df50dafcf55f49ba47e6
SSDEEP

1536:0d7jipTa3sbm9e5MqwUT1cf9ndgWul5U4wUyDPQRoXktf6:0dvlOcqwN7ylw4RoXkF6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1232	1808	regsvr32.exe	28
PID 1808 wrote to memory of 1232	1808	regsvr32.exe	28
PID 1808 wrote to memory of 1232	1808	regsvr32.exe	28
PID 1808 wrote to memory of 1232	1808	regsvr32.exe	28
PID 1808 wrote to memory of 1232	1808	regsvr32.exe	28
PID 1808 wrote to memory of 1232	1808	regsvr32.exe	28
PID 1808 wrote to memory of 1232	1808	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\358a93de3b50a306bd61ca0d61caf45fe2449f53.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\358a93de3b50a306bd61ca0d61caf45fe2449f53.dll
  2⤵
  PID:1232

memory/1232-56-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download
memory/1232-57-0x0000000000210000-0x0000000000259000-memory.dmp

Filesize
292KB

Download
memory/1808-54-0x000007FEFB7C1000-0x000007FEFB7C3000-memory.dmp

Filesize
8KB

Download