97c00910940f43ed12c20466cac4541a2f874a42ae02dd7a4ff8b2c64499ffda

Resubmissions

06/04/2023, 23:01

13/03/2023, 09:58

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
13/03/2023, 09:58

Target

35c0744bec0e123d24a9ffd3d7a9edeb07d9341ab45619b5fc881ce7dd81276a.dll
Size

254.5MB
MD5

98ef8e5ef3bef928537d4fd25c53380a
SHA1

7d3255275bff63faa31bca7d2ec87ec4408151a5
SHA256

35c0744bec0e123d24a9ffd3d7a9edeb07d9341ab45619b5fc881ce7dd81276a
SHA512

57fb7b746068f6a626f850d438acdeeeaf1e2f0c68e7ea0ed98082b3bcce914f5e050423ad0095e7d1268d6e9415ba12134a03b9a689b9533ccf13a9f940fd2c
SSDEEP

49152:0hha9qUyO2Dmpso/Xls3L1NRRuU0gjMAlwLhdBf7hd3RZHFTcTPfT56xnhY:0hw9qUy5G/VsbvREgKxVd3jglwhY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 3920	3216	regsvr32.exe	85
PID 3216 wrote to memory of 3920	3216	regsvr32.exe	85
PID 3216 wrote to memory of 3920	3216	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\35c0744bec0e123d24a9ffd3d7a9edeb07d9341ab45619b5fc881ce7dd81276a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\35c0744bec0e123d24a9ffd3d7a9edeb07d9341ab45619b5fc881ce7dd81276a.dll
  2⤵
  PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3920 -ip 3920
1⤵
PID:220

memory/3920-133-0x00000000022C0000-0x00000000032C0000-memory.dmp

Filesize
16.0MB

Download