935697cf52195e8d11ca283e61d0a384f2462e13afb1145903e4e7458a5bba11

Analysis

max time kernel
145s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 07:33

Target

935697cf52195e8d11ca283e61d0a384f2462e13afb1145903e4e7458a5bba11.dll
Size

256KB
MD5

1f8ac9065205b00156f67c55eac23e45
SHA1

530a2603bc0f5168d862397c92186f944e33d50b
SHA256

935697cf52195e8d11ca283e61d0a384f2462e13afb1145903e4e7458a5bba11
SHA512

7b58bc44f245091e8296fa57dcbe0c2ee7c2939db92ab01f1ced25679dcfe06769c09b178684e4eb2b7f904b6d7639252153db00e4dd00d4547adf0ac30a9a93
SSDEEP

6144:oma83qfjkCzqmgsNstyJU18vE1gKKC0e6:omjmgsnygKKB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 4564	2748	regsvr32.exe	82
PID 2748 wrote to memory of 4564	2748	regsvr32.exe	82
PID 2748 wrote to memory of 4564	2748	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\935697cf52195e8d11ca283e61d0a384f2462e13afb1145903e4e7458a5bba11.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\935697cf52195e8d11ca283e61d0a384f2462e13afb1145903e4e7458a5bba11.dll
  2⤵
  PID:4564

memory/4564-133-0x0000000002C70000-0x0000000002CB0000-memory.dmp

Filesize
256KB

Download