055987930bd9298208f538d63bbd79a46158fde009d047f55699c56739518f85

Analysis

max time kernel
84s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2023, 18:20

Target

055987930bd9298208f538d63bbd79a46158fde009d047f55699c56739518f85.dll
Size

64KB
MD5

8cc378ba3285e7924e388a2b8220de69
SHA1

0fe02961bab286ef6a98eab22611986e0a929600
SHA256

055987930bd9298208f538d63bbd79a46158fde009d047f55699c56739518f85
SHA512

8825f413d648ac07dde664d94a711a5c581724938cc812423aa454827836b29789b69bd3eb747a0d040e3f39c36c578b5b13962c977d05481751072b98e0f1bf
SSDEEP

768:IpXg0bUHbh0+fqpG5S0A4hRyz1SJlDo3xqXBvZ:pN0+fqpG5o4hMz1ch

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2232	1872	regsvr32.exe	82
PID 1872 wrote to memory of 2232	1872	regsvr32.exe	82
PID 1872 wrote to memory of 2232	1872	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\055987930bd9298208f538d63bbd79a46158fde009d047f55699c56739518f85.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\055987930bd9298208f538d63bbd79a46158fde009d047f55699c56739518f85.dll
  2⤵
  PID:2232