0654404ac323055c7e0ea342ed75836ae2936790009faa5606373c983d887223

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 11:07

Target
0654404ac323055c7e0ea342ed75836ae2936790009faa5606373c983d887223.dll
Size 588KB
Sample221129-m7yqcsch33
SHA256 0654404ac323055c7e0ea342ed75836ae2936790009faa5606373c983d887223
MD5 49f8b9bd4cef9fdb074cadc3f3321260
SHA1 e74b7b83eb2eaffffc07642dd4718c1d195ba919
SHA512 492148f66fd782a565fe3bc7c0472bd0ce2e9700df584d6cf56945bc0a4609263f2cf28dbcc16098c4c40f855e9c90d06ded1e9ba4d976ddfd33c48da870e0a8
SSDEEP 768:TS8e8pYY2uXZ9hAVawuStKIZ+2fJcwqVETAz4HMBbsjjRGPZMo3pV:fOY2IGe7IZ+nVETAzFs1fo33
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 3152	5016	regsvr32.exe	81
PID 5016 wrote to memory of 3152	5016	regsvr32.exe	81
PID 5016 wrote to memory of 3152	5016	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0654404ac323055c7e0ea342ed75836ae2936790009faa5606373c983d887223.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0654404ac323055c7e0ea342ed75836ae2936790009faa5606373c983d887223.dll
  2⤵
  PID:3152