8847acf3b25b3508a03dc10f353e4710eaae0caeba19188733e22174f6238b76

Analysis

max time kernel
117s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2023, 19:29

Target

XMLData.dll
Size

196KB
MD5

a9402a3c46c46b1b911769622ab75f03
SHA1

f68274a7cb68efec18772437893e2aa46f0d5e55
SHA256

8847acf3b25b3508a03dc10f353e4710eaae0caeba19188733e22174f6238b76
SHA512

07e3e26ee385848ec318bd27b411003b69c3e4d7a13208f2f09cadbab9dd40b658025238b143628b8ed76cf25d5abd4b6e99fffc3fb1e9165c75930590babf98
SSDEEP

3072:wmmNPt0QojBdYLxe6nXi3wFRlBXeGwg5TV2Q5SfBUVb7iRaNGbEtV7PDV8Gg+/cW:wfHojUnBOG2giRaUItp1c6B

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 4984	1712	regsvr32.exe	82
PID 1712 wrote to memory of 4984	1712	regsvr32.exe	82
PID 1712 wrote to memory of 4984	1712	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\XMLData.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\XMLData.dll
  2⤵
  PID:4984