f55797f046b1b04931b78bb085d18f620fab7a77472c7a571bebd10b1791304a

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2023, 13:24

Target

358a93de3b50a306bd61ca0d61caf45fe2449f53.dll
Size

69KB
MD5

19be67e0356a3a292eaccbf41db640bb
SHA1

358a93de3b50a306bd61ca0d61caf45fe2449f53
SHA256

f55797f046b1b04931b78bb085d18f620fab7a77472c7a571bebd10b1791304a
SHA512

b927c2783d86850866a7b71410da8d8d326baa2ec945b471eadd95ea88fe3f5991ca239b0ee5cae48feca6ba6f26f336ac61f8cf7472df50dafcf55f49ba47e6
SSDEEP

1536:0d7jipTa3sbm9e5MqwUT1cf9ndgWul5U4wUyDPQRoXktf6:0dvlOcqwN7ylw4RoXkF6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 4756	4744	regsvr32.exe	82
PID 4744 wrote to memory of 4756	4744	regsvr32.exe	82
PID 4744 wrote to memory of 4756	4744	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\358a93de3b50a306bd61ca0d61caf45fe2449f53.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\358a93de3b50a306bd61ca0d61caf45fe2449f53.dll
  2⤵
  PID:4756