0de05524e9e2c94220be1df9f09d2b3a3b1d15a4659f69f7bf8271366ae0a91b

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2022, 14:30

Target
10000000.dll
Size 39KB
Sample220901-rt5zqsehbr
SHA256 0de05524e9e2c94220be1df9f09d2b3a3b1d15a4659f69f7bf8271366ae0a91b
MD5 9401560f606e617d88d3001f7e54c31e
SHA1 df9822733711e7b7948786703b6123f25b57bf94
SHA512 61a6334ab95b1e5503ec1077365eb8b6e7d90d47dd4e3231e4a0189237378967fb83f3e81bc463b4118a3b51a941ed8b523ed553f876f31bcafc61a9e1b72895
SSDEEP 768:A24rU7eukUXM7dWVvuyTdcNtW2RTYBfx6w39rDE3Lkjx2K/ZK38u3O:KaeuZM7MQideD8B56w39HE384h387
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 3440	4376	regsvr32.exe	85
PID 4376 wrote to memory of 3440	4376	regsvr32.exe	85
PID 4376 wrote to memory of 3440	4376	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\10000000.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\10000000.dll
  2⤵
  PID:3440