89da48a7276109cdb34d89aa7ba8ea14d66d6d3dd8807a8bf0168f1bf6d0ad43

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 06:46

Target

89da48a7276109cdb34d89aa7ba8ea14d66d6d3dd8807a8bf0168f1bf6d0ad43.dll
Size

575KB
MD5

51af967a6f22badfdb2d1ba6498303f0
SHA1

2a01bf878f0e6334eb8848e31bfd175d6d0677ab
SHA256

89da48a7276109cdb34d89aa7ba8ea14d66d6d3dd8807a8bf0168f1bf6d0ad43
SHA512

b90e7ddf547b0276dbbc94b44d0044e9d2a1852d7f2f451c63c10e5cd2db87708d514eb8d33f6be195e5b21eb34746fb117f394e9dee999a8628775b55bc9e6d
SSDEEP

6144:SJ+KmjNZP5vuY90aBBeZRAiulbQOuzq2ePOrR5k3WO:5LjNtl0iBeLuBYzpewk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 2296	3488	regsvr32.exe	81
PID 3488 wrote to memory of 2296	3488	regsvr32.exe	81
PID 3488 wrote to memory of 2296	3488	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\89da48a7276109cdb34d89aa7ba8ea14d66d6d3dd8807a8bf0168f1bf6d0ad43.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\89da48a7276109cdb34d89aa7ba8ea14d66d6d3dd8807a8bf0168f1bf6d0ad43.dll
  2⤵
  PID:2296

memory/2296-133-0x000000004BDE0000-0x000000004BE7A000-memory.dmp

Filesize
616KB

Download