2b5ef06034e85fd7b0310711269ee2c64bae99d3abb169964999f6d6ba27916b

Analysis

max time kernel
119s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 19:38

Target
2b5ef06034e85fd7b0310711269ee2c64bae99d3abb169964999f6d6ba27916b.dll
Size 1.1MB
Sample221003-ycws3achc5
SHA256 2b5ef06034e85fd7b0310711269ee2c64bae99d3abb169964999f6d6ba27916b
MD5 3ae7ab7fa9cca28699e9f813fc634ef0
SHA1 f94dea51d9889c0aadbf2a63f9f3b65061a0ff1c
SHA512 ff400f4cb6b649462d15439317e4bdbc557293c0e94d380e0f354712813054588998e99c2a332927487d40c86c6007f40ee9c35074b381a5cec0d9d92bae2f65
SSDEEP 24576:8u59F55A+NU3DlFN2BLwwZKEp5x5Wi2UJ/LOfQbSpHs5H0ZP:tbvQDl+TZzZbsM5H
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 424	4436	regsvr32.exe	84
PID 4436 wrote to memory of 424	4436	regsvr32.exe	84
PID 4436 wrote to memory of 424	4436	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2b5ef06034e85fd7b0310711269ee2c64bae99d3abb169964999f6d6ba27916b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2b5ef06034e85fd7b0310711269ee2c64bae99d3abb169964999f6d6ba27916b.dll
  2⤵
  PID:424