da373c150b5186a7d4e512a6730dc512c377c8867777ecdb9e1939c8bbe7a4cf

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 23:22

Target

da373c150b5186a7d4e512a6730dc512c377c8867777ecdb9e1939c8bbe7a4cf.dll
Size

137KB
MD5

0ee651998653a8ad1df40a7e6edb2173
SHA1

7b9cb96614ba3b97d59bc0490f8804a045afb465
SHA256

da373c150b5186a7d4e512a6730dc512c377c8867777ecdb9e1939c8bbe7a4cf
SHA512

5902808f40962597e7a2189ca9787425ca92447dd5f5244306978a6285a9c856fa4f0a73221ceb132ffebd2595b82592d75e6151ad5f9e0ed54052e9845b1448
SSDEEP

3072:2va6tOSk4eJw6BBO/ku0pBTNBoJ5Pn2+mfyGlca:QPAd4uJTuOPae+Ta

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2688	2820	regsvr32.exe	79
PID 2820 wrote to memory of 2688	2820	regsvr32.exe	79
PID 2820 wrote to memory of 2688	2820	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\da373c150b5186a7d4e512a6730dc512c377c8867777ecdb9e1939c8bbe7a4cf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\da373c150b5186a7d4e512a6730dc512c377c8867777ecdb9e1939c8bbe7a4cf.dll
  2⤵
  PID:2688