59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1

Resubmissions

21-02-2023 11:37

17-02-2023 05:38

13-02-2023 12:09

08-02-2023 04:11

max time kernel
83s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-02-2023 04:11

Target

59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1.dll
Size

1.0MB
MD5

46808efd5331489a931e51792623caca
SHA1

1e7e75bcee397e9c447edb7a7a20a5c81eee8a87
SHA256

59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1
SHA512

33fcf014dba7718a7e99a4860854b6067e525c8e1ab187dd9468fd4913fe7fe450b89beb5c915e424288857ce6137f96ef970d26b9bd061991d1d6a97e63b853
SSDEEP

24576:oYwf5ZRmacuzNSmFa10450twvOUqEB7PBd3X3m+r:WcCzNfveyUdPBdH3l

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 112	1076	regsvr32.exe	26
PID 1076 wrote to memory of 112	1076	regsvr32.exe	26
PID 1076 wrote to memory of 112	1076	regsvr32.exe	26
PID 1076 wrote to memory of 112	1076	regsvr32.exe	26
PID 1076 wrote to memory of 112	1076	regsvr32.exe	26
PID 1076 wrote to memory of 112	1076	regsvr32.exe	26
PID 1076 wrote to memory of 112	1076	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1.dll
  2⤵
  PID:112

memory/112-56-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1076-54-0x000007FEFC431000-0x000007FEFC433000-memory.dmp

Filesize
8KB

Download