d22c788d7e8d6c36a4807493b19ba7866c1c1956a8e80be668590105c85fcb90

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/04/2024, 03:40

Target

d22c788d7e8d6c36a4807493b19ba7866c1c1956a8e80be668590105c85fcb90.dll
Size

428KB
MD5

a730e9ca2602f788a04d3e604f3da2b7
SHA1

0fee066e164950306ccd423c87c7246385b12da2
SHA256

d22c788d7e8d6c36a4807493b19ba7866c1c1956a8e80be668590105c85fcb90
SHA512

ae2d1059f58106a7a45a1431f25cc97e5fdcfc39c830fb30896ccac7c9980776efa37e795a0b699cc6ac00cba5c52bf725fddbc0b58755509a693a974537544f
SSDEEP

12288:QVkWUYGyAXEL7QRBubC24q5UsMO22HBZTPDMRfzn/:pWUYGyH7QLubC24tsMO26TPufL/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2844	2956	regsvr32.exe	28
PID 2956 wrote to memory of 2844	2956	regsvr32.exe	28
PID 2956 wrote to memory of 2844	2956	regsvr32.exe	28
PID 2956 wrote to memory of 2844	2956	regsvr32.exe	28
PID 2956 wrote to memory of 2844	2956	regsvr32.exe	28
PID 2956 wrote to memory of 2844	2956	regsvr32.exe	28
PID 2956 wrote to memory of 2844	2956	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d22c788d7e8d6c36a4807493b19ba7866c1c1956a8e80be668590105c85fcb90.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d22c788d7e8d6c36a4807493b19ba7866c1c1956a8e80be668590105c85fcb90.dll
  2⤵
  PID:2844

memory/2844-1-0x0000000000340000-0x000000000037E000-memory.dmp

Filesize
248KB

Download
memory/2844-0-0x0000000000340000-0x000000000037E000-memory.dmp

Filesize
248KB

Download