6f8c35ba78a7231e71e69a5ff2578a1f78c6c74cbc26a8e5a3807b222e5cf384

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2023, 19:06

Target

6f8c35ba78a7231e71e69a5ff2578a1f78c6c74cbc26a8e5a3807b222e5cf384.dll
Size

1.6MB
MD5

b892f4ec2762881186f7fab984bb991a
SHA1

90ac8cfcbdced9644146269b96fccb74719b4a43
SHA256

6f8c35ba78a7231e71e69a5ff2578a1f78c6c74cbc26a8e5a3807b222e5cf384
SHA512

27e394e887177902a65d4570072eaceb27901176d09a757dd0cf5a13b5a737659ee32512dd788e6c6153664a31501c2e1e10c7cabcfa8b4b1313941022882097
SSDEEP

24576:fpMB0haU20ucA6g+OHXllFtDs8wKgLhARLD1VM:a0d20M+OHXllF71D1VM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 3832	3340	regsvr32.exe	81
PID 3340 wrote to memory of 3832	3340	regsvr32.exe	81
PID 3340 wrote to memory of 3832	3340	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6f8c35ba78a7231e71e69a5ff2578a1f78c6c74cbc26a8e5a3807b222e5cf384.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6f8c35ba78a7231e71e69a5ff2578a1f78c6c74cbc26a8e5a3807b222e5cf384.dll
  2⤵
  PID:3832