75d628e3ae278fb8a4007ec86853894f44558141c0f55f3649e47692c9e1e72b

Analysis

max time kernel
174s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 00:16

Target

75d628e3ae278fb8a4007ec86853894f44558141c0f55f3649e47692c9e1e72b.dll
Size

164KB
MD5

79d13087687b7fc5487a03d5250fd9b0
SHA1

904711066a458106b77040b2692a72eab5f253ea
SHA256

75d628e3ae278fb8a4007ec86853894f44558141c0f55f3649e47692c9e1e72b
SHA512

02f22047f0022f5e050f3d9bb2c86f7436330d4c11c270d46664415539d78d5ae53687e78b8992ea71726de2d6f4463cbbf6ff527c316e8ed6ff943e3887b138
SSDEEP

3072:TLgej89OAtFdz2LXXVoeA77mTZk4ibHWdJx3ok:TE9OAtHqTVor7m+hbCxYk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 4912	2100	regsvr32.exe	81
PID 2100 wrote to memory of 4912	2100	regsvr32.exe	81
PID 2100 wrote to memory of 4912	2100	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\75d628e3ae278fb8a4007ec86853894f44558141c0f55f3649e47692c9e1e72b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\75d628e3ae278fb8a4007ec86853894f44558141c0f55f3649e47692c9e1e72b.dll
  2⤵
  PID:4912

memory/4912-133-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download