3f013a2d61656df00f8c914e44e6cbf902032d0a3b7378184179e6c55e248f0f

Analysis

max time kernel
90s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 12:53

Target

3f013a2d61656df00f8c914e44e6cbf902032d0a3b7378184179e6c55e248f0f.dll
Size

210KB
MD5

eb4952585a634e548a83375b960ca4c0
SHA1

e191cc39d762e0b1a5c97463c43691a494479ca2
SHA256

3f013a2d61656df00f8c914e44e6cbf902032d0a3b7378184179e6c55e248f0f
SHA512

29dc7c1a6b89623c1bdc71cd67e6efdd55013790e4f9bf4be4283c4c6a263dd62b5c6cb865a4186c13a95f9220879e7087b6771286fca1c3079e83b40b8a0b4f
SSDEEP

3072:lusa8Ca3YnPwo/xKYDDoP4jsKoWtnz71Nk2qYVG0MC1u7kLxAIag2hGWV:Y68YoHDFV1N1kYiIag6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4796	4872	regsvr32.exe	81
PID 4872 wrote to memory of 4796	4872	regsvr32.exe	81
PID 4872 wrote to memory of 4796	4872	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3f013a2d61656df00f8c914e44e6cbf902032d0a3b7378184179e6c55e248f0f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3f013a2d61656df00f8c914e44e6cbf902032d0a3b7378184179e6c55e248f0f.dll
  2⤵
  PID:4796