17f00476ba3b80b94fe3205f017436657200c33bdc14810a4520dd46c98f4deb

Analysis

max time kernel
268s
max time network
334s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:03

Target

17f00476ba3b80b94fe3205f017436657200c33bdc14810a4520dd46c98f4deb.dll
Size

673KB
MD5

17497fb89361244f5df0925a42ff00bc
SHA1

713e29c93e1faaebbc10eca53bc5917287495652
SHA256

17f00476ba3b80b94fe3205f017436657200c33bdc14810a4520dd46c98f4deb
SHA512

8dab1876bf965b548faf4cb07e71799263c30b6ff04be2f6374124bff03ab4eb8290790e5b4e7648f8b001bfcead9476311c6cdcae21353701186ba80a5e828f
SSDEEP

6144:4xpP4xjVMOm+sjywDGbgYe57PHp64yMQfv3yWTJqDh1zHINTJe1wDbDLxNQXItR:4xR0V09ywqbgBPc6dlHIuifD1t

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 764 wrote to memory of 1000	764	regsvr32.exe	regsvr32.exe
PID 764 wrote to memory of 1000	764	regsvr32.exe	regsvr32.exe
PID 764 wrote to memory of 1000	764	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\17f00476ba3b80b94fe3205f017436657200c33bdc14810a4520dd46c98f4deb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\17f00476ba3b80b94fe3205f017436657200c33bdc14810a4520dd46c98f4deb.dll
2⤵
PID:1000