08da2414b97649f0b0ff698dc811828a467c14920dc23a26db95f668ccae7119

Resubmissions

06/04/2023, 23:02

13/03/2023, 10:24

max time kernel
140s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
13/03/2023, 10:24

Target

84c71f7d2147673b3298b5ab6f4dce8a6bb488f8d4235b580799872e4c00e862.dll
Size

336.9MB
MD5

245257717c97504cdd4dbe261a2c47d0
SHA1

eba71c5923560e405201f467bcefa41b47887298
SHA256

84c71f7d2147673b3298b5ab6f4dce8a6bb488f8d4235b580799872e4c00e862
SHA512

b6c1cfef353e0df9a8c37ce8532f84cdc35cd852f34554f2748cbd74dd259329a6c733af5f8515faa8605070660afbac08f88af86f4f85b6f71f5a8a938868da
SSDEEP

49152:snKYCefvv6dyezQTbcPCg8vZ37FSc4o6qyeQVTQTPvTd1c:sXCe3sEcPX86X5388

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3208	4816	regsvr32.exe	83
PID 4816 wrote to memory of 3208	4816	regsvr32.exe	83
PID 4816 wrote to memory of 3208	4816	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\84c71f7d2147673b3298b5ab6f4dce8a6bb488f8d4235b580799872e4c00e862.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\84c71f7d2147673b3298b5ab6f4dce8a6bb488f8d4235b580799872e4c00e862.dll
  2⤵
  PID:3208

memory/3208-133-0x0000000002800000-0x0000000003800000-memory.dmp

Filesize
16.0MB

Download