b1370e087876367d2190c4e41630f17ff973b963f43e25a55ab93236c6d562ee

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-03-2023 06:47

Target

Microsoft.Uev.AgentWmi.dll
Size

1.0MB
MD5

10528ca8bdfd1f0a8031b7643e2ba488
SHA1

2de145bc2cc1cc3dd3598b9034fc8554efb56254
SHA256

b1370e087876367d2190c4e41630f17ff973b963f43e25a55ab93236c6d562ee
SHA512

ca9a7161b459c47d49d5a13ab44d5ff17bc03a780b35d2587899010b4b9ae29503a8f484160b7e829e169e05d77361248310d2eb58d409b6811048523b635fc7
SSDEEP

24576:GX4lEqOyfL/TKcJpDffb4iqosljiodMg+DW9YM0h3a73aEW1HANFr3X+L+qd5an9:GolfybdOD64YKEW1gNFrHud5an9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1596	1948	regsvr32.exe	26
PID 1948 wrote to memory of 1596	1948	regsvr32.exe	26
PID 1948 wrote to memory of 1596	1948	regsvr32.exe	26
PID 1948 wrote to memory of 1596	1948	regsvr32.exe	26
PID 1948 wrote to memory of 1596	1948	regsvr32.exe	26
PID 1948 wrote to memory of 1596	1948	regsvr32.exe	26
PID 1948 wrote to memory of 1596	1948	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Microsoft.Uev.AgentWmi.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Microsoft.Uev.AgentWmi.dll
  2⤵
  PID:1596