d8d97950e70533fdf1f14f002b7b29b37ec57aa9bc552cf5c25f498edf48b9d6

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 10:18

Target

d8d97950e70533fdf1f14f002b7b29b37ec57aa9bc552cf5c25f498edf48b9d6.dll
Size

1.2MB
MD5

317b1ea7ecbd6ea6448538f8cefae520
SHA1

57080e045d44aebcdd74b492cf5022c70635387d
SHA256

d8d97950e70533fdf1f14f002b7b29b37ec57aa9bc552cf5c25f498edf48b9d6
SHA512

f1cc36d8190405648e157490e3ae75c58bc8daf9414cb35272e385a577e8de5fc534cc569b27d4d295a027b964f295466967cf68112832fd49ac4c1b02edb5c8
SSDEEP

24576:N2Ud3zDBThoKwSURh3VXb1RRvKTadSpHs5H0NhVrn:IUd3bnw3FxRRiTUsM5H2hZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 1100	4344	regsvr32.exe	79
PID 4344 wrote to memory of 1100	4344	regsvr32.exe	79
PID 4344 wrote to memory of 1100	4344	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d8d97950e70533fdf1f14f002b7b29b37ec57aa9bc552cf5c25f498edf48b9d6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d8d97950e70533fdf1f14f002b7b29b37ec57aa9bc552cf5c25f498edf48b9d6.dll
  2⤵
  PID:1100

memory/1100-133-0x00000000747F0000-0x0000000074936000-memory.dmp

Filesize
1.3MB

Download
memory/1100-134-0x00000000747F0000-0x0000000074936000-memory.dmp

Filesize
1.3MB

Download