765327e1dc0888c69c92203d90037c5154db9787f54d3fc8f1097830be8c76ab

Analysis

max time kernel
140s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 18:39

Target

765327e1dc0888c69c92203d90037c5154db9787f54d3fc8f1097830be8c76ab.dll
Size

767KB
MD5

0de24cec66ef9d1042be7cf12b87cfc4
SHA1

f7bf7cea89c6205d78fa42d735d81c1e5c183041
SHA256

765327e1dc0888c69c92203d90037c5154db9787f54d3fc8f1097830be8c76ab
SHA512

0eef5ebf2f82cc0c5fe081b6e5bf88d9e6f92d9d8d9a147300f6423cb5626bd58f54547047fc59f63179f402822b8ad9afbd1ade590ff82f00081c43d4d834c7
SSDEEP

12288:VP2nI91nFoMW9XeJSGadgR0O+VPhV/2DyqHO/Dzy4wE4rieJ:VY2BadgRLgP1hbzy4Yrl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 5112	3444	regsvr32.exe	82
PID 3444 wrote to memory of 5112	3444	regsvr32.exe	82
PID 3444 wrote to memory of 5112	3444	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\765327e1dc0888c69c92203d90037c5154db9787f54d3fc8f1097830be8c76ab.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\765327e1dc0888c69c92203d90037c5154db9787f54d3fc8f1097830be8c76ab.dll
  2⤵
  PID:5112

memory/5112-133-0x0000000001220000-0x000000000125F000-memory.dmp

Filesize
252KB

Download
memory/5112-139-0x0000000001220000-0x000000000125F000-memory.dmp

Filesize
252KB

Download