b17382097026eb2f4340f075b18c1435f85284b74dff9e6f4eb123fa94b2050f

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 10:31

Target

b17382097026eb2f4340f075b18c1435f85284b74dff9e6f4eb123fa94b2050f.dll
Size

256KB
MD5

400262d0316eb5d60684890406118c30
SHA1

a7f34dd0aa57e1fc95feab9b961eeb054d2d4236
SHA256

b17382097026eb2f4340f075b18c1435f85284b74dff9e6f4eb123fa94b2050f
SHA512

967ecf9e966ef3ffe8941431725da37686f314622daa0d3027800dd45483a28251d871439e4c5904e3c13971b0a9a0d5cee7a87c1112732e888ed8340714d1aa
SSDEEP

6144:TubZtB6ioIiZT3nJx8mpgNzD4baK7n+cN:Q6ioIiZTZxyD4OKLr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 2516	3084	regsvr32.exe	80
PID 3084 wrote to memory of 2516	3084	regsvr32.exe	80
PID 3084 wrote to memory of 2516	3084	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b17382097026eb2f4340f075b18c1435f85284b74dff9e6f4eb123fa94b2050f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b17382097026eb2f4340f075b18c1435f85284b74dff9e6f4eb123fa94b2050f.dll
  2⤵
  PID:2516