1112505820b2ddfbc0c1306073bd504635895fe865e4b03ecf76b4ef30051e73

Resubmissions

06/04/2023, 23:00

13/03/2023, 10:25

max time kernel
143s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
13/03/2023, 10:25

Target

ec07e185f5df2d07b1c83f65e13e5cc9a77dd1c42aa311bac2eaf7cc921d8d4d.dll
Size

298.0MB
MD5

fefc02dd495ab8b6adf74b6f9d69e774
SHA1

699246876e6140a4dc3a7c44578565628f1accfa
SHA256

ec07e185f5df2d07b1c83f65e13e5cc9a77dd1c42aa311bac2eaf7cc921d8d4d
SHA512

ce579859d7d97952e444ee2ac5e1fa83f5957451045da1ad8dccf928d1c9e1e2abd18063f8c0deabf1a8d21322b6c44e10ecfde7cb58ec027f653cdb842fc32c
SSDEEP

196608:dywqPjZL2prjsEr5NUR4ureIXH5yJ7nxkYuQPP3r7DbGF/UALgV:dy8jsEr5NUR4ureIXYjTuQPPy/UQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 4580	632	regsvr32.exe	83
PID 632 wrote to memory of 4580	632	regsvr32.exe	83
PID 632 wrote to memory of 4580	632	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ec07e185f5df2d07b1c83f65e13e5cc9a77dd1c42aa311bac2eaf7cc921d8d4d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ec07e185f5df2d07b1c83f65e13e5cc9a77dd1c42aa311bac2eaf7cc921d8d4d.dll
  2⤵
  PID:4580

memory/4580-133-0x0000000002B70000-0x0000000003B70000-memory.dmp

Filesize
16.0MB

Download