9017c070ad6ac9ac52e361286b3ff24a315f721f488b53b7aaf6ac35de477f44

Analysis

max time kernel
91s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 18:39

Target

9017c070ad6ac9ac52e361286b3ff24a315f721f488b53b7aaf6ac35de477f44.dll
Size

769KB
MD5

6f600974c45eec97016c1259e769a4ef
SHA1

56eed20ea731d28d621723130518ac00bf50170d
SHA256

9017c070ad6ac9ac52e361286b3ff24a315f721f488b53b7aaf6ac35de477f44
SHA512

468c84bf4f5324c4a87c7bc79b2a4c878893d4ede3691f2c3a779c718da20601b13fd79474acb6004b6f58bb2e21fbd70a1698e6bc7bbe43635e8be727f149fd
SSDEEP

12288:DPjiD91nFoMWpWgjltgTg490dJ5NAdYlY97rvlaOCTLfXt:DeciYFU8OAX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3920 wrote to memory of 1536	3920	regsvr32.exe	regsvr32.exe
PID 3920 wrote to memory of 1536	3920	regsvr32.exe	regsvr32.exe
PID 3920 wrote to memory of 1536	3920	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9017c070ad6ac9ac52e361286b3ff24a315f721f488b53b7aaf6ac35de477f44.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3920

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\9017c070ad6ac9ac52e361286b3ff24a315f721f488b53b7aaf6ac35de477f44.dll
2⤵
PID:1536

memory/1536-132-0x0000000000000000-mapping.dmp

Download
memory/1536-133-0x00000000008E0000-0x000000000091F000-memory.dmp

Filesize
252KB

Download
memory/1536-139-0x00000000008E0000-0x000000000091F000-memory.dmp

Filesize
252KB

Download