b40be094696c60e586d8ab1d726578bf04ff8d96d4d1cb0b0e14a2d95c263fcd

Analysis

max time kernel
305s
max time network
367s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 16:46

Target

b40be094696c60e586d8ab1d726578bf04ff8d96d4d1cb0b0e14a2d95c263fcd.dll
Size

38KB
MD5

4fcdf23624624484cffdd3d7e852a2f3
SHA1

0f8c990ea73218dd51aab0da67e3d3b1b48dd6e6
SHA256

b40be094696c60e586d8ab1d726578bf04ff8d96d4d1cb0b0e14a2d95c263fcd
SHA512

3459bad891002a99c5a6b8cca87582e78ba0f1d7cb9f7ff1a2b638fded7bfd6ec5fe499ff4d71a8c1d3de3af5e0dbe2100827a9646ec3efff46fcd3a5adf9206
SSDEEP

768:uTERvKYRgrpRqt6LuSBQ6qRD549AFlgsQAygevZL:FKsgFRqtAuS66q/49AwsQAygevZL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 1488	616	regsvr32.exe	79
PID 616 wrote to memory of 1488	616	regsvr32.exe	79
PID 616 wrote to memory of 1488	616	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b40be094696c60e586d8ab1d726578bf04ff8d96d4d1cb0b0e14a2d95c263fcd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b40be094696c60e586d8ab1d726578bf04ff8d96d4d1cb0b0e14a2d95c263fcd.dll
  2⤵
  PID:1488