932778732711cd18d5c4aabc507a65180bf1d4bd2b7d2d4e5506be4b8193596e

Analysis

max time kernel
91s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 18:43

Target

932778732711cd18d5c4aabc507a65180bf1d4bd2b7d2d4e5506be4b8193596e.dll
Size

795KB
MD5

ac33fea4c2a9bbca3559142838441f84
SHA1

948ef8caef5c1254be551cab8a64c687ea0faf84
SHA256

932778732711cd18d5c4aabc507a65180bf1d4bd2b7d2d4e5506be4b8193596e
SHA512

fb0281077f3c679ce359b58f79c8643c8e3a6f57b8c5cbaa10b26a08ecd862b3f4b411754de1cfae9cfe64fdcb89e9ef71d79ae573d77647b7be81d44b1d390c
SSDEEP

12288:WmEv6GDiRtf+3j4rPoYm6TXeYjPZtHHRnM+1qgD:WmG68YwY1VltHHRDv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 2196	3856	regsvr32.exe	82
PID 3856 wrote to memory of 2196	3856	regsvr32.exe	82
PID 3856 wrote to memory of 2196	3856	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\932778732711cd18d5c4aabc507a65180bf1d4bd2b7d2d4e5506be4b8193596e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\932778732711cd18d5c4aabc507a65180bf1d4bd2b7d2d4e5506be4b8193596e.dll
  2⤵
  PID:2196

memory/2196-133-0x0000000000CD0000-0x0000000000D0F000-memory.dmp

Filesize
252KB

Download
memory/2196-139-0x0000000000CD0000-0x0000000000D0F000-memory.dmp

Filesize
252KB

Download