8fe96a98404a44e6477d431a4a42cd8bf3c599ea77521a8a43483b3c1f75fadd

Analysis

max time kernel
209s
max time network
227s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2022, 01:17

Target

8fe96a98404a44e6477d431a4a42cd8bf3c599ea77521a8a43483b3c1f75fadd.dll
Size

35KB
MD5

9153386762624c0274b45b7a111248c0
SHA1

21d78e2335124bbed5e87e57be635e5add13ebfc
SHA256

8fe96a98404a44e6477d431a4a42cd8bf3c599ea77521a8a43483b3c1f75fadd
SHA512

bbb4283458c5a5d7eb116f6985f5bcc79b0eebd1a654e011a6d13f35c0ef3bd4d41946bdf9f790d4e86cec77259219b86c04d8a63b080fbebacb27754b4e5991
SSDEEP

768:9mhCjjxFtqZLus2AgYRDCbFFJ6I7NNJNdwQ:Z9C6s2rYRDyJ6I7Nr

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1008	1660	regsvr32.exe	79
PID 1660 wrote to memory of 1008	1660	regsvr32.exe	79
PID 1660 wrote to memory of 1008	1660	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8fe96a98404a44e6477d431a4a42cd8bf3c599ea77521a8a43483b3c1f75fadd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8fe96a98404a44e6477d431a4a42cd8bf3c599ea77521a8a43483b3c1f75fadd.dll
  2⤵
  - Drops file in Windows directory
  PID:1008

memory/1008-133-0x00000000005D0000-0x00000000005D7000-memory.dmp

Filesize
28KB

Download
memory/1008-134-0x00000000005D0000-0x00000000005D7000-memory.dmp

Filesize
28KB

Download