13f8e0f8c53ef2b4bf32ce2181ece4a297858b7aa295eeb48cf38afbf63ee3c9

Analysis

max time kernel
148s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 10:45

Target

13f8e0f8c53ef2b4bf32ce2181ece4a297858b7aa295eeb48cf38afbf63ee3c9.dll
Size

588KB
MD5

56d99fba8a10928164caf86eb4e29470
SHA1

0a4a3b807bc54d93a81ff59eec9444e86c991581
SHA256

13f8e0f8c53ef2b4bf32ce2181ece4a297858b7aa295eeb48cf38afbf63ee3c9
SHA512

dac5293fdb012bf60ec3e928ae3359d784ad0aa00f2c8872547828d7832d2ecac7c721601d6b52607a441df33ec7b412337cf18eeeb2ba3fc4ec63d0409ec4ee
SSDEEP

1536:QGkmYRQcowbqwI81hDTlBSaDzdlK+hiKbZXwBBkH+6o3L7VNsU6:EmYRsanP1hrSaDzDZX2k+6o3LZGU6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 2164	3132	regsvr32.exe	84
PID 3132 wrote to memory of 2164	3132	regsvr32.exe	84
PID 3132 wrote to memory of 2164	3132	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\13f8e0f8c53ef2b4bf32ce2181ece4a297858b7aa295eeb48cf38afbf63ee3c9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\13f8e0f8c53ef2b4bf32ce2181ece4a297858b7aa295eeb48cf38afbf63ee3c9.dll
  2⤵
  PID:2164