ccb159e2119afad2d0ba90cf0e573519250cce5c11bb4184db504d2b39146535

Analysis

max time kernel
149s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2022 04:02

Target

ccb159e2119afad2d0ba90cf0e573519250cce5c11bb4184db504d2b39146535.dll
Size

19KB
MD5

103baef5347e37c279ec4303861a2d22
SHA1

6059999e25eb6f894d258fda4ed3fd5ebb355509
SHA256

ccb159e2119afad2d0ba90cf0e573519250cce5c11bb4184db504d2b39146535
SHA512

c3a788192dace34598f1ad089a36b09d4fa51406d98e638631f7c302ab5628baf1c3e2e87f610762a854d161865ffb415e71dfdfa77120e9f272513449115766
SSDEEP

384:eWWTEcWePKORLzOIB5X5mFh0V4wKOZk+SaJgD/JSu11h:VaKORLzOIBF5yCq8ZkTaqD5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 4568	4844	regsvr32.exe	80
PID 4844 wrote to memory of 4568	4844	regsvr32.exe	80
PID 4844 wrote to memory of 4568	4844	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ccb159e2119afad2d0ba90cf0e573519250cce5c11bb4184db504d2b39146535.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ccb159e2119afad2d0ba90cf0e573519250cce5c11bb4184db504d2b39146535.dll
  2⤵
  PID:4568

memory/4568-132-0x0000000000000000-mapping.dmp

Download
memory/4568-133-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download