2d651c5a3535e38b75947ef4367e640ca2963f90eb3a5d9e7a60c1aaaabefd26

Analysis

max time kernel
150s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 20:14

Target

2d651c5a3535e38b75947ef4367e640ca2963f90eb3a5d9e7a60c1aaaabefd26.dll
Size

120KB
MD5

76ff8b61ca7ece9d1733c20a5e1b2490
SHA1

a156b57f5e27efa7654fde6ca5e42f1d8681295a
SHA256

2d651c5a3535e38b75947ef4367e640ca2963f90eb3a5d9e7a60c1aaaabefd26
SHA512

ba3e6fb5e7eb339272cbe7e2228584af35385ac4b8f7b8ade6964a1f0603ba1ed71aa459e934383d9c16cd174642a59ff29527c18af5f9eb5931abe4392d94a3
SSDEEP

1536:cxqiQ5wGb3TFO1UKPmdWYtDheR+7ecAgBJosMOGnR:YCw+g6K8Z5w07e9gBGlRR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 4984	3988	regsvr32.exe	82
PID 3988 wrote to memory of 4984	3988	regsvr32.exe	82
PID 3988 wrote to memory of 4984	3988	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2d651c5a3535e38b75947ef4367e640ca2963f90eb3a5d9e7a60c1aaaabefd26.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2d651c5a3535e38b75947ef4367e640ca2963f90eb3a5d9e7a60c1aaaabefd26.dll
  2⤵
  PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4984 -ip 4984
1⤵
PID:4940

memory/4984-133-0x00000000004D0000-0x00000000004EE000-memory.dmp

Filesize
120KB

Download
memory/4984-134-0x00000000004D0000-0x00000000004EE000-memory.dmp

Filesize
120KB

Download
memory/4984-135-0x00000000004D0000-0x00000000004EE000-memory.dmp

Filesize
120KB

Download