d0b50241cc21af062e8ab2f85241facffbeda1b28d34dcc40d65088f8f9f4897

Analysis

max time kernel
102s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-03-2023 20:08

Target

d0b50241cc21af062e8ab2f85241facffbeda1b28d34dcc40d65088f8f9f4897.dll
Size

144KB
MD5

e62b20bba48004ced338f64329af0319
SHA1

53f70ed53a1d86ba29287831d8461992f93eed0e
SHA256

d0b50241cc21af062e8ab2f85241facffbeda1b28d34dcc40d65088f8f9f4897
SHA512

e1489d5a118c87b5126a9b7e9e2fdde9365cfb793b6b6fd652d0f2b9e5b795ea78c9782e88b116d303e8e80ee272ece471453f20005a457d6f9d26fa375d945d
SSDEEP

3072:/pRCtKlvegubx+YLGR+dOkRs88ywLl3nI0+9kwMhv4v:hRTGguQYLACRs53zwMx4

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

4248 regsvr32.exe
4248 regsvr32.exe

pid	process
4248	regsvr32.exe
4248	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4180 wrote to memory of 4248	4180	regsvr32.exe	regsvr32.exe
PID 4180 wrote to memory of 4248	4180	regsvr32.exe	regsvr32.exe
PID 4180 wrote to memory of 4248	4180	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d0b50241cc21af062e8ab2f85241facffbeda1b28d34dcc40d65088f8f9f4897.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4180

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\d0b50241cc21af062e8ab2f85241facffbeda1b28d34dcc40d65088f8f9f4897.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4248