b60840cda47483f38e580b79c6a1997541362d57ef50136f39a650099056b9b2

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 08:11

Target

b60840cda47483f38e580b79c6a1997541362d57ef50136f39a650099056b9b2.dll
Size

128KB
MD5

1649fa30382df30084a70341a6f45ff0
SHA1

2e8f576712b518ac2ded18c0abe0f7307db719b2
SHA256

b60840cda47483f38e580b79c6a1997541362d57ef50136f39a650099056b9b2
SHA512

639ecac990db3a0388cbbb1f0467cf92c26a7b3fe66f5fe41729045e40cc2a7d0d8ed683be56e728033f155eb9e76c399c7c4ba7cb486430854f9cbc68a10535
SSDEEP

1536:ZDfR/ro2LeV/dFPzmqiTyaDLhYETtyGqgo+XossFmu1k6:ZhrDeV/rPz7oqHGDo+XossUu1k6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 1388	4640	regsvr32.exe	40
PID 4640 wrote to memory of 1388	4640	regsvr32.exe	40
PID 4640 wrote to memory of 1388	4640	regsvr32.exe	40

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b60840cda47483f38e580b79c6a1997541362d57ef50136f39a650099056b9b2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b60840cda47483f38e580b79c6a1997541362d57ef50136f39a650099056b9b2.dll
  2⤵
  PID:1388