c1bae889da7252c8aa7c7446117a0dfd0e285621de369f5a9c204ac5662b11dd

Resubmissions

07/02/2023, 14:13

07/02/2023, 14:08

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/02/2023, 14:08

Target

wbroidpyUsiqfHRGEXoN-Q4oViHeNp9anCBKxWYrEd0.dll
Size

143KB
MD5

920625c516d7184fed4610279dd6c164
SHA1

6e1fc17dd3965d707a29f0ca2ad01f693fe506b6
SHA256

c1bae889da7252c8aa7c7446117a0dfd0e285621de369f5a9c204ac5662b11dd
SHA512

3a6b0b7bb654384699f06db91f8bc287be128f6dc57e6fb2d19129d2557e04f311b6201a8783483790751645c0df8d702265bed7d09380019d09ceee74052058
SSDEEP

3072:8uZ6hcvJTZ9oVFBfnIyht8vPs1XQHBC92ePuH:dTN4HBnI2t8vPLu6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1428	1652	regsvr32.exe	26
PID 1652 wrote to memory of 1428	1652	regsvr32.exe	26
PID 1652 wrote to memory of 1428	1652	regsvr32.exe	26
PID 1652 wrote to memory of 1428	1652	regsvr32.exe	26
PID 1652 wrote to memory of 1428	1652	regsvr32.exe	26
PID 1652 wrote to memory of 1428	1652	regsvr32.exe	26
PID 1652 wrote to memory of 1428	1652	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\wbroidpyUsiqfHRGEXoN-Q4oViHeNp9anCBKxWYrEd0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\wbroidpyUsiqfHRGEXoN-Q4oViHeNp9anCBKxWYrEd0.dll
  2⤵
  PID:1428

memory/1428-56-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/1428-57-0x00000000000E0000-0x00000000000E5000-memory.dmp

Filesize
20KB

Download
memory/1428-58-0x0000000000130000-0x0000000000137000-memory.dmp

Filesize
28KB

Download
memory/1652-54-0x000007FEFB871000-0x000007FEFB873000-memory.dmp

Filesize
8KB

Download