a932ea0f18f0671d92c64df7e2001e2a8ca7a96d3fc9e9d71810c79b29ccb38d

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 23:07

Target

a932ea0f18f0671d92c64df7e2001e2a8ca7a96d3fc9e9d71810c79b29ccb38d.dll
Size

588KB
MD5

92243581d2086e8ae43b6af6c3dbff30
SHA1

4baa0a3c91388e825b8ba391254ce225caf262c8
SHA256

a932ea0f18f0671d92c64df7e2001e2a8ca7a96d3fc9e9d71810c79b29ccb38d
SHA512

84107f7948470e0d0adc81ec3bf456352d1941a76fa6886240b6a5f561ce9f89065ed1f2eb20bfc63318af04d6931c9a6e83e579e1438a893944dfda93e0bc39
SSDEEP

12288:dHztGB6l9ia4Lv68yoaaPu5vb+YF/zYwQm8:dJGwl9ia4Lv68yoaam5vb+u/zl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 4088	448	regsvr32.exe	80
PID 448 wrote to memory of 4088	448	regsvr32.exe	80
PID 448 wrote to memory of 4088	448	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a932ea0f18f0671d92c64df7e2001e2a8ca7a96d3fc9e9d71810c79b29ccb38d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a932ea0f18f0671d92c64df7e2001e2a8ca7a96d3fc9e9d71810c79b29ccb38d.dll
  2⤵
  PID:4088