8257494f614ee64531313ca9203fba5b2c7e48437b193c1de50d950382269e2d

Analysis

max time kernel
163s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 20:10

Target

8257494f614ee64531313ca9203fba5b2c7e48437b193c1de50d950382269e2d.dll
Size

19KB
MD5

f6080e57a2f55322ca8df27e516da23e
SHA1

82f643835026988993fbafcbb61994d7ba4e16e1
SHA256

8257494f614ee64531313ca9203fba5b2c7e48437b193c1de50d950382269e2d
SHA512

bf2817c01aec091a07ab5efdbc02b09f80a95ed014078561621d3c77afd51dad5e619ee6f72f1811d280c818c63d5fb6e0d7c5c808aa768f85de9b50bc031dd1
SSDEEP

384:4WWTEcWGPJO3U2ztAwRXVRDjaoxAkQR20qS/Tzp0NJNiFBqCACpSA:zqQD+AfqkQwEANiBqCXpP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1360	1260	regsvr32.exe	82
PID 1260 wrote to memory of 1360	1260	regsvr32.exe	82
PID 1260 wrote to memory of 1360	1260	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8257494f614ee64531313ca9203fba5b2c7e48437b193c1de50d950382269e2d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8257494f614ee64531313ca9203fba5b2c7e48437b193c1de50d950382269e2d.dll
  2⤵
  PID:1360