3d58d92d34cc3ada7e15a02816cd2388b10591618d2c29ed35e1786526265926

Analysis

max time kernel
179s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 01:10

Target

3d58d92d34cc3ada7e15a02816cd2388b10591618d2c29ed35e1786526265926.dll
Size

143KB
MD5

27578daec66f4cc4891ce4a029207300
SHA1

9c361704568c671949f41580845d21b2e67ea9db
SHA256

3d58d92d34cc3ada7e15a02816cd2388b10591618d2c29ed35e1786526265926
SHA512

e25f6db75cc05ea5f7a5a3c51c1bf325a68ecb9c47852ba717871653a22122606fc8f8cd0332d4acdce967f1fd04d44ab4b8c7e017f256bb688a89e8d6dff820
SSDEEP

3072:NMQehZRwDur+suLi/SjHY4gV8BcHem/hSfr57PmwnOinC:NMnZRwarqOSDY4gOBcHem/QfNPmwnOiC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 444	1096	regsvr32.exe	85
PID 1096 wrote to memory of 444	1096	regsvr32.exe	85
PID 1096 wrote to memory of 444	1096	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3d58d92d34cc3ada7e15a02816cd2388b10591618d2c29ed35e1786526265926.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3d58d92d34cc3ada7e15a02816cd2388b10591618d2c29ed35e1786526265926.dll
  2⤵
  PID:444

memory/444-133-0x0000000074FB0000-0x0000000074FD7000-memory.dmp

Filesize
156KB

Download
memory/444-134-0x0000000000770000-0x000000000077F000-memory.dmp

Filesize
60KB

Download
memory/444-135-0x0000000074FB0000-0x0000000074FD7000-memory.dmp

Filesize
156KB

Download
memory/444-136-0x0000000000850000-0x000000000085F000-memory.dmp

Filesize
60KB

Download