67ff4734bb63b2d24f09d14e80ec3565a4a8ce4036815b8c94b4aad522074ccd

Analysis

max time kernel
4s
max time network
2s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 16:49

Target

67ff4734bb63b2d24f09d14e80ec3565a4a8ce4036815b8c94b4aad522074ccd.dll
Size

36KB
MD5

65e0fe69803a8948e6cc66d8fd84e46c
SHA1

4cbd6cd0e62a0aef4b4709edb28c944ff4b9476a
SHA256

67ff4734bb63b2d24f09d14e80ec3565a4a8ce4036815b8c94b4aad522074ccd
SHA512

d8cd3fa215a090091d036e6b4cc7999a6d106f8805883272ba371ae34e3be5ed85dec462f9633b661761a7ade4a57a04ca682aa8a2302d210dd937f8aa6f6d8f
SSDEEP

768:zQoi6qZOMQOppi+iaOiqjC3mKnuZbcUKdQwr28w:zQv6qZpQcHIKuh32

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1928	1996	regsvr32.exe	77
PID 1996 wrote to memory of 1928	1996	regsvr32.exe	77
PID 1996 wrote to memory of 1928	1996	regsvr32.exe	77

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\67ff4734bb63b2d24f09d14e80ec3565a4a8ce4036815b8c94b4aad522074ccd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\67ff4734bb63b2d24f09d14e80ec3565a4a8ce4036815b8c94b4aad522074ccd.dll
  2⤵
  PID:1928

memory/1928-133-0x0000000000760000-0x000000000076E000-memory.dmp

Filesize
56KB

Download