3a1fcf6a50cafad00781b906a3417b68aa5abbdd7d1c6ced1a6feb9eefccfb37

Analysis

max time kernel
198s
max time network
256s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 20:18

Target

3a1fcf6a50cafad00781b906a3417b68aa5abbdd7d1c6ced1a6feb9eefccfb37.dll
Size

120KB
MD5

5693099804bf0151e7874778b910d9cd
SHA1

9b6ba7b2a1e3d8cd682b1e4a60aeb81a0ce4a72b
SHA256

3a1fcf6a50cafad00781b906a3417b68aa5abbdd7d1c6ced1a6feb9eefccfb37
SHA512

a0af14bd6f07d15916b8019fc34a09f2f5a9bda8e684f8b7753aad9357fad3587d26f9601615b4e34a6ce957cc74f0a9071aeda62b336dcfc352b8404361c0dd
SSDEEP

1536:OlqcQf8EVmtoAap73Q+jZsisiuxnf2j1DezyG:kw8Eyrap8YsifuxfY1iGG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 4464	4920	regsvr32.exe	80
PID 4920 wrote to memory of 4464	4920	regsvr32.exe	80
PID 4920 wrote to memory of 4464	4920	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3a1fcf6a50cafad00781b906a3417b68aa5abbdd7d1c6ced1a6feb9eefccfb37.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3a1fcf6a50cafad00781b906a3417b68aa5abbdd7d1c6ced1a6feb9eefccfb37.dll
  2⤵
  PID:4464

memory/4464-133-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download