1bc781130f5722aaa8bc888aac935355f7b70476e39e815ee10dbb35ac580f3b

Analysis

max time kernel
189s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 11:25

Target

1bc781130f5722aaa8bc888aac935355f7b70476e39e815ee10dbb35ac580f3b.dll
Size

251KB
MD5

83e421381e9156926897f78a07264413
SHA1

88d13760afdf1e21ab2c0ab49729f58e5b843d04
SHA256

1bc781130f5722aaa8bc888aac935355f7b70476e39e815ee10dbb35ac580f3b
SHA512

66971bcfeee77552764212a4ba0401670f3485c1a9700a943384639d192e6fb8c27e9cd49c651db79e937abd3d1eb053f4c59c64a1caea2eac163557050b9647
SSDEEP

6144:VsYtrO/EbqEaYSFrP/SQtSDDMoEVDWeDny:VTta/qaYSFGwBVDWgn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 380	112	regsvr32.exe	83
PID 112 wrote to memory of 380	112	regsvr32.exe	83
PID 112 wrote to memory of 380	112	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1bc781130f5722aaa8bc888aac935355f7b70476e39e815ee10dbb35ac580f3b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1bc781130f5722aaa8bc888aac935355f7b70476e39e815ee10dbb35ac580f3b.dll
  2⤵
  PID:380

memory/380-133-0x00000000754E0000-0x0000000075521000-memory.dmp

Filesize
260KB

Download
memory/380-134-0x0000000000650000-0x000000000065D000-memory.dmp

Filesize
52KB

Download
memory/380-135-0x0000000000660000-0x000000000066D000-memory.dmp

Filesize
52KB

Download
memory/380-136-0x0000000000660000-0x000000000066D000-memory.dmp

Filesize
52KB

Download