7094b7664f0c4c534e9d59ca7edbad5124ea6070e0d76b13eb7c9547dcc11018

Analysis

max time kernel
251s
max time network
312s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2022, 18:06

Target
7094b7664f0c4c534e9d59ca7edbad5124ea6070e0d76b13eb7c9547dcc11018.dll
Size 398KB
Sample221130-wp3q2afd81
SHA256 7094b7664f0c4c534e9d59ca7edbad5124ea6070e0d76b13eb7c9547dcc11018
MD5 785fb2c39514539ce70fc746d2ad8318
SHA1 1ee0aef05c7ee37ba98010451feea52a2c2487e0
SHA512 8072e8d87a9c72b17d2509456cf9bf14ddd1ce58bcc87f0f484de233934bb7b16891d44ab34562932b2d9e813b16e1c7119459f28187bef17b5d0c6c97527749
SSDEEP 6144:a9ykYklEwrPmRPWEpWFn2E6lyDntvhhOU35RJEesN23wU7HuAmHK+N:02wr03pdf8vhhOKJET8Byq+N
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2744	1936	regsvr32.exe	81
PID 1936 wrote to memory of 2744	1936	regsvr32.exe	81
PID 1936 wrote to memory of 2744	1936	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7094b7664f0c4c534e9d59ca7edbad5124ea6070e0d76b13eb7c9547dcc11018.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7094b7664f0c4c534e9d59ca7edbad5124ea6070e0d76b13eb7c9547dcc11018.dll
  2⤵
  PID:2744