af538ab1b8bdfbf5b7f1548d72c0d042eb14d0011d796cab266f0671720abb4d

Analysis

max time kernel
127s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 17:33

Target

af538ab1b8bdfbf5b7f1548d72c0d042eb14d0011d796cab266f0671720abb4d.dll
Size

768KB
MD5

b196bc4d3bea5b7922b98d9ba9eb8e2b
SHA1

901cee60fba225baf80c976b10dfa1684a73f5ee
SHA256

af538ab1b8bdfbf5b7f1548d72c0d042eb14d0011d796cab266f0671720abb4d
SHA512

6ab517257bb30930d43c8e06fee4c3a6115f40d0f6d808b2d52f358d8cb94d93433cd968f825e7e4eb8fe0eba6949b42e8b4a849dc6f14408dcaa0a1a233e97b
SSDEEP

12288:WP9Fk91nFoMWTbxUW/U56Tsf0zIeUIQBy4xK5eM3mFrq5JvwXT6Jp:WfsLKxUIQBy41qmU5JoDw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 3140	4792	regsvr32.exe	83
PID 4792 wrote to memory of 3140	4792	regsvr32.exe	83
PID 4792 wrote to memory of 3140	4792	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\af538ab1b8bdfbf5b7f1548d72c0d042eb14d0011d796cab266f0671720abb4d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\af538ab1b8bdfbf5b7f1548d72c0d042eb14d0011d796cab266f0671720abb4d.dll
  2⤵
  PID:3140