72ebe5d76fe31eb584cf70aa1d4103fffe2054fd7e2783aca1cf76d54ab38bf0

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 01:14

Target
72ebe5d76fe31eb584cf70aa1d4103fffe2054fd7e2783aca1cf76d54ab38bf0.dll
Size 432KB
Sample221204-blq8lsdf26
SHA256 72ebe5d76fe31eb584cf70aa1d4103fffe2054fd7e2783aca1cf76d54ab38bf0
MD5 ce881f75058bb8bc2acd853569838350
SHA1 f1b189e2b16d54b7423af52209f95e8cedc73b41
SHA512 e1113f4f4a73654f71ed4f2abfc6815471e44ef3916a203f6a768bdf6a25314c3d8640945fa95fdaeb6dc2db96ef4d75ae5b8cec4454290ec0d6d8725af82c01
SSDEEP 6144:3CnJtKFKgoMvnE1P6/pofRWq+m0zyx3h6l66x4zcKgHh8iyI1kd:3Y6Z/yJInqix32iyI
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 4828	2080	regsvr32.exe	79
PID 2080 wrote to memory of 4828	2080	regsvr32.exe	79
PID 2080 wrote to memory of 4828	2080	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\72ebe5d76fe31eb584cf70aa1d4103fffe2054fd7e2783aca1cf76d54ab38bf0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\72ebe5d76fe31eb584cf70aa1d4103fffe2054fd7e2783aca1cf76d54ab38bf0.dll
  2⤵
  PID:4828

memory/4828-133-0x00000000667F0000-0x000000006685E000-memory.dmp

Download

memory/4828-134-0x00000000667F0000-0x000000006685E000-memory.dmp

Download

memory/4828-135-0x0000000002230000-0x0000000002254000-memory.dmp

Download