39f95ecb7d82b71dcb4cc874ee1579a65869ec681dee38e7ba80da8f92ae9177

Analysis

max time kernel
186s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 22:18

Target

autocopy/ArmAccess.dll
Size

52KB
MD5

c841204b08d5a330f4e0503430f82e24
SHA1

5720d7eba4fdae55a7e67cfe3637cfda02d2e953
SHA256

089869db6efb52ce41dc6f0ab859164c7a316f4ae082cdc45b1ea7921fd42505
SHA512

22542300bc25ea84906c2ec7fd0588a9be67f9c44732f1c9c3ac8f2049a1941f2c746888c5635beb6a00049743cbb322143d698af7d501e9f5fc17738900e9ea
SSDEEP

384:TWNNgJdY59tTulkbETxYpx6y2LfiqoYBUcz837yIYh9JzxovS1f2uUIiho38oqee:SIwTulXtkmfZBe7EtFovs2I38ozSihb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 5080 wrote to memory of 2276	5080	regsvr32.exe	regsvr32.exe
PID 5080 wrote to memory of 2276	5080	regsvr32.exe	regsvr32.exe
PID 5080 wrote to memory of 2276	5080	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\autocopy\ArmAccess.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\autocopy\ArmAccess.dll
  2⤵
  PID:2276