72ebe5d76fe31eb584cf70aa1d4103fffe2054fd7e2783aca1cf76d54ab38bf0

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 01:14

Target

72ebe5d76fe31eb584cf70aa1d4103fffe2054fd7e2783aca1cf76d54ab38bf0.dll
Size

432KB
MD5

ce881f75058bb8bc2acd853569838350
SHA1

f1b189e2b16d54b7423af52209f95e8cedc73b41
SHA256

72ebe5d76fe31eb584cf70aa1d4103fffe2054fd7e2783aca1cf76d54ab38bf0
SHA512

e1113f4f4a73654f71ed4f2abfc6815471e44ef3916a203f6a768bdf6a25314c3d8640945fa95fdaeb6dc2db96ef4d75ae5b8cec4454290ec0d6d8725af82c01
SSDEEP

6144:3CnJtKFKgoMvnE1P6/pofRWq+m0zyx3h6l66x4zcKgHh8iyI1kd:3Y6Z/yJInqix32iyI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 4828	2080	regsvr32.exe	79
PID 2080 wrote to memory of 4828	2080	regsvr32.exe	79
PID 2080 wrote to memory of 4828	2080	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\72ebe5d76fe31eb584cf70aa1d4103fffe2054fd7e2783aca1cf76d54ab38bf0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\72ebe5d76fe31eb584cf70aa1d4103fffe2054fd7e2783aca1cf76d54ab38bf0.dll
  2⤵
  PID:4828

memory/4828-133-0x00000000667F0000-0x000000006685E000-memory.dmp

Filesize
440KB

Download
memory/4828-134-0x00000000667F0000-0x000000006685E000-memory.dmp

Filesize
440KB

Download
memory/4828-135-0x0000000002230000-0x0000000002254000-memory.dmp

Filesize
144KB

Download