6093f3750cd52549a923ec5c66a6b9bf904c93a0a70e4a6b5068bc9685c5897e

Analysis

max time kernel
98s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 20:26

Target

6093f3750cd52549a923ec5c66a6b9bf904c93a0a70e4a6b5068bc9685c5897e.dll
Size

116KB
MD5

fbcd935406cc90b4e3663f57f4306fb0
SHA1

42e8e547cbece68ac0de58860e55d98587616eb7
SHA256

6093f3750cd52549a923ec5c66a6b9bf904c93a0a70e4a6b5068bc9685c5897e
SHA512

63887592c0b46d883da61bdbaa58ffac79a7757416b278a095f78ba198056c12126eaa819d4c5efef743b909e4f50d42cc920d2394ab19bc9c8252ef4496fbe5
SSDEEP

1536:jBAvBqZ+Qid1iiQ2zDVmPKjsiUUtuKWNuB6Ax:9AU+tKKjsiMKid0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 3612	2312	regsvr32.exe	80
PID 2312 wrote to memory of 3612	2312	regsvr32.exe	80
PID 2312 wrote to memory of 3612	2312	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6093f3750cd52549a923ec5c66a6b9bf904c93a0a70e4a6b5068bc9685c5897e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6093f3750cd52549a923ec5c66a6b9bf904c93a0a70e4a6b5068bc9685c5897e.dll
  2⤵
  PID:3612

memory/3612-133-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download