85ea47499796002ee773858f0f174304edd56f47718f22d2eebd0c4b82562bc1

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 16:56

Target

85ea47499796002ee773858f0f174304edd56f47718f22d2eebd0c4b82562bc1.dll
Size

5.9MB
MD5

f50f8de114089dafed90e215b7ea6b0c
SHA1

1bb2db18bdbadaac9ef543880bdf41781ac9629b
SHA256

85ea47499796002ee773858f0f174304edd56f47718f22d2eebd0c4b82562bc1
SHA512

105538a6c5df7fd3c0c5f351348e4b22d1c3fdca4db3caa8a796fa06e902c59752e4aa67333d58118c6cccbabc7d7ffdba662f4ad672b2fcfbddf4e9981bcaa7
SSDEEP

98304:yFpXmtvxzsLugPwBX9Q+WwXfnjYJ7t8ktRdmfmW9tGdpZxWH:SXmtdKc0J7t8ktRdmfpYM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 3720	1676	regsvr32.exe	85
PID 1676 wrote to memory of 3720	1676	regsvr32.exe	85
PID 1676 wrote to memory of 3720	1676	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\85ea47499796002ee773858f0f174304edd56f47718f22d2eebd0c4b82562bc1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\85ea47499796002ee773858f0f174304edd56f47718f22d2eebd0c4b82562bc1.dll
  2⤵
  PID:3720

memory/3720-0-0x0000000010000000-0x00000000104D9000-memory.dmp

Filesize
4.8MB

Download
memory/3720-1-0x0000000002B00000-0x000000000331B000-memory.dmp

Filesize
8.1MB

Download
memory/3720-2-0x0000000003390000-0x0000000003C8A000-memory.dmp

Filesize
9.0MB

Download
memory/3720-3-0x0000000002AE0000-0x0000000002AE2000-memory.dmp

Filesize
8KB

Download
memory/3720-4-0x0000000002B00000-0x000000000331B000-memory.dmp

Filesize
8.1MB

Download
memory/3720-5-0x0000000001360000-0x0000000001376000-memory.dmp

Filesize
88KB

Download
memory/3720-6-0x0000000003390000-0x0000000003C8A000-memory.dmp

Filesize
9.0MB

Download
memory/3720-7-0x0000000002AE0000-0x0000000002AE2000-memory.dmp

Filesize
8KB

Download
memory/3720-8-0x0000000001360000-0x0000000001376000-memory.dmp

Filesize
88KB

Download
memory/3720-9-0x0000000003390000-0x0000000003C8A000-memory.dmp

Filesize
9.0MB

Download