b3b614c0bc2925681240bb1adf157a97e0018e7b48ca0bfdee0e6b292400cd0a

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25/10/2022, 19:06

Target

b3b614c0bc2925681240bb1adf157a97e0018e7b48ca0bfdee0e6b292400cd0a.dll
Size

119KB
MD5

eba4c124bac7d765d581aa77ae01af93
SHA1

fb4d0a7c846a8e5f228dbf10430867c19e9034f8
SHA256

b3b614c0bc2925681240bb1adf157a97e0018e7b48ca0bfdee0e6b292400cd0a
SHA512

71d7210d1d5c4a8b1ffb513ede5e7dc5c904111ed2ede6a227ea96e856a0a8bbf791ed3eb7cdacb1a876c426b32d4ed8ec771edc42b6fb9d63145691dc09719b
SSDEEP

3072:ta8vm1CRhon8iTGlPkzzRn/eepTJp7J1LdC5epCYFjG+fF78pwgsaO:tvvoA28iTGSXRnW2J1Leepjdv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 1296	3404	regsvr32.exe	84
PID 3404 wrote to memory of 1296	3404	regsvr32.exe	84
PID 3404 wrote to memory of 1296	3404	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b3b614c0bc2925681240bb1adf157a97e0018e7b48ca0bfdee0e6b292400cd0a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b3b614c0bc2925681240bb1adf157a97e0018e7b48ca0bfdee0e6b292400cd0a.dll
  2⤵
  PID:1296