7e87ee593c31a2f718741b7fdce79e854386286e69c2ecc53022a2d5d64dad3c

Analysis

max time kernel
120s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 14:15

Target

7e87ee593c31a2f718741b7fdce79e854386286e69c2ecc53022a2d5d64dad3c.dll
Size

18KB
MD5

45171ddf2a8911a01a867e141258b9f6
SHA1

366a3bd00b4378f014088eeb49b356a856698667
SHA256

7e87ee593c31a2f718741b7fdce79e854386286e69c2ecc53022a2d5d64dad3c
SHA512

2d4d0272539c1c08f1024b5baba15c3b704f0929193ab982108bee940cb06be9696dbfbb32cd06c9fa667fd89cff838fc1ec673149d7de24aadce44fc29cdbce
SSDEEP

384:ZKWWTEcW5BjJjTlbY1lPSBy5AWOv3W0jXBgI6FHuQYW8eVtW:ZBJjJfVutSDr3vBgI6t5Y8C

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 2180	3456	regsvr32.exe	81
PID 3456 wrote to memory of 2180	3456	regsvr32.exe	81
PID 3456 wrote to memory of 2180	3456	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7e87ee593c31a2f718741b7fdce79e854386286e69c2ecc53022a2d5d64dad3c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7e87ee593c31a2f718741b7fdce79e854386286e69c2ecc53022a2d5d64dad3c.dll
  2⤵
  PID:2180