74d4f60fb0d1af5dc231a59cf7471051d3b2c0ad3e50cbbaf7dccf64ab75d10f

Analysis

max time kernel
97s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 01:50

Target

74d4f60fb0d1af5dc231a59cf7471051d3b2c0ad3e50cbbaf7dccf64ab75d10f.dll
Size

88KB
MD5

481b450980bb5b45383913f99011fd90
SHA1

fe1dd0b92f1da47f67867661e7c93aacf0a12ec5
SHA256

74d4f60fb0d1af5dc231a59cf7471051d3b2c0ad3e50cbbaf7dccf64ab75d10f
SHA512

a2715f2c22fb66359758e9776acbce1daac152fb30f0309cdf5a2d17d25ea0e8be9a2652c89f9c1047733cf74bdbafb487b6d80b390adfb1d4fc705fafe45080
SSDEEP

1536:04QSax7ZRiZ1742lZmjG+qL6e5hT9ik2UmJwWhG:04qzRiZ182nWG+qu6T9xmJwWhG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2984	1936	regsvr32.exe	81
PID 1936 wrote to memory of 2984	1936	regsvr32.exe	81
PID 1936 wrote to memory of 2984	1936	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\74d4f60fb0d1af5dc231a59cf7471051d3b2c0ad3e50cbbaf7dccf64ab75d10f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\74d4f60fb0d1af5dc231a59cf7471051d3b2c0ad3e50cbbaf7dccf64ab75d10f.dll
  2⤵
  PID:2984

memory/2984-134-0x00000000011D0000-0x00000000011D5000-memory.dmp

Filesize
20KB

Download