45db12c53194a50d8892c5823b6bd28e50f4a152494c4d6e3c1c694c0798b8dd

Analysis

max time kernel
83s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 11:08

Target

45db12c53194a50d8892c5823b6bd28e50f4a152494c4d6e3c1c694c0798b8dd.dll
Size

81KB
MD5

4271e846f1b6cd502124c2af0d531620
SHA1

319fe0dbc6fbdccb9ffc9b45ef28d4e1f9cd3a56
SHA256

45db12c53194a50d8892c5823b6bd28e50f4a152494c4d6e3c1c694c0798b8dd
SHA512

23f639af0a62fee0a88c2527bc1bdf5ef2154b2dcac2bffe1cce01b325a72caa5460fedab428883379117bda4c11762e96132bfe5160221d60e410addf51f332
SSDEEP

1536:+p1qnTQf6yPPzjoWQtO6w65mQoLaCv5KGjkcOkC8eggGAvN+HPYVF:+wTxynPQtV5P2aCv5KGjkj8ePvN+HPYz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 2160	4180	regsvr32.exe	83
PID 4180 wrote to memory of 2160	4180	regsvr32.exe	83
PID 4180 wrote to memory of 2160	4180	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\45db12c53194a50d8892c5823b6bd28e50f4a152494c4d6e3c1c694c0798b8dd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\45db12c53194a50d8892c5823b6bd28e50f4a152494c4d6e3c1c694c0798b8dd.dll
  2⤵
  PID:2160

memory/2160-133-0x00000000005E0000-0x00000000005FA000-memory.dmp

Filesize
104KB

Download