4d66db64263c1556bed0ffe64f824a2b17e556353532b1ad760eee5dbcaad986

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 18:27

Target

4d66db64263c1556bed0ffe64f824a2b17e556353532b1ad760eee5dbcaad986.dll
Size

212KB
MD5

3bbccdb96d4ad6540a5140384bfbf3d0
SHA1

1a11051f1d8950ad444faf1be66747ac66cdfe1d
SHA256

4d66db64263c1556bed0ffe64f824a2b17e556353532b1ad760eee5dbcaad986
SHA512

6649486ee2b6458f7938ab0db861bb85982cb3af8c3e41595d12d046d8ea3fb83b49183491b091e99bdaa71b673dea453ed3d7c66d838b38aa2a3ad4b619d719
SSDEEP

3072:ULsqzxK02qEQCdxGYTxZ4NqgbdyYJiStxEm1LUu:U5g0KLeYTxZRLYJXjEC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 1944	2412	regsvr32.exe	80
PID 2412 wrote to memory of 1944	2412	regsvr32.exe	80
PID 2412 wrote to memory of 1944	2412	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4d66db64263c1556bed0ffe64f824a2b17e556353532b1ad760eee5dbcaad986.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4d66db64263c1556bed0ffe64f824a2b17e556353532b1ad760eee5dbcaad986.dll
  2⤵
  PID:1944

memory/1944-133-0x0000000020000000-0x0000000020035000-memory.dmp

Filesize
212KB

Download