3e5a6834cf6192a987ca9b0b4c8cb9202660e399ebe387af8c7407b12ae2da63

Resubmissions

02-10-2022 17:55

02-10-2022 17:38

max time kernel
139s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 17:55

Target

3e5a6834cf6192a987ca9b0b4c8cb9202660e399ebe387af8c7407b12ae2da63.dll
Size

790KB
MD5

1d6aa29e98d3f54b8c891929c34eb426
SHA1

ceca1a691c736632b3e98f2ed5b028d33c0f3c64
SHA256

3e5a6834cf6192a987ca9b0b4c8cb9202660e399ebe387af8c7407b12ae2da63
SHA512

58eb6150dde73277e06b5e27e102a8ad183978937133394656fcf68a2cc20d84cf5f554225af65d8cfa8d3a51b0b8f096b52afec9d1417b0ecedd499adda4896
SSDEEP

12288:b/8j+2vE6ywjfSUbMdkbtqpVGA5Sb15NAKtOWzm4w8Qa79fz:b/mpvWkBqjkhHm5ax

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4812 wrote to memory of 4864	4812	regsvr32.exe	regsvr32.exe
PID 4812 wrote to memory of 4864	4812	regsvr32.exe	regsvr32.exe
PID 4812 wrote to memory of 4864	4812	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3e5a6834cf6192a987ca9b0b4c8cb9202660e399ebe387af8c7407b12ae2da63.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4812

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\3e5a6834cf6192a987ca9b0b4c8cb9202660e399ebe387af8c7407b12ae2da63.dll
2⤵
PID:4864

memory/4864-132-0x0000000000000000-mapping.dmp

Download
memory/4864-133-0x0000000000A50000-0x0000000000A8F000-memory.dmp

Filesize
252KB

Download
memory/4864-139-0x0000000000A50000-0x0000000000A8F000-memory.dmp

Filesize
252KB

Download