499e6e02a40abc049b3bcb7c6871cb530b5f0fc7bd96c47f583ee9120834a37f

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 18:25

Target
499e6e02a40abc049b3bcb7c6871cb530b5f0fc7bd96c47f583ee9120834a37f.dll
Size 128KB
Sample221011-w23a2aheel
SHA256 499e6e02a40abc049b3bcb7c6871cb530b5f0fc7bd96c47f583ee9120834a37f
MD5 1880c82feefa371999ff4ab391c79d80
SHA1 74911294307e791af2197df6a24ba6690b4c3879
SHA512 cef5636ef047e352661f82edc6a3c7835048e3e94bd0760008abe0be68a68313c241be864efcd1ecf0adde97dad0f4c2a70cedaf756f8db449b2917394bde218
SSDEEP 1536:GUgJ+bOg2rWyvmULwsQqdnITBNQIZnCLzsRA6:GrrWyv7wc8iItCLzsRH
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1792	2988	regsvr32.exe	53
PID 2988 wrote to memory of 1792	2988	regsvr32.exe	53
PID 2988 wrote to memory of 1792	2988	regsvr32.exe	53

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\499e6e02a40abc049b3bcb7c6871cb530b5f0fc7bd96c47f583ee9120834a37f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\499e6e02a40abc049b3bcb7c6871cb530b5f0fc7bd96c47f583ee9120834a37f.dll
  2⤵
  PID:1792