e5258f592532a4592652feaa74a34a912738b19508b0e7745eb4c78f1a23808b

Analysis

max time kernel
139s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 15:36

Target

e5258f592532a4592652feaa74a34a912738b19508b0e7745eb4c78f1a23808b.dll
Size

657KB
MD5

42a8133fd0de3bd5eb6177df81b968c1
SHA1

5b1ce466e8006b81a863289312d0caf385197854
SHA256

e5258f592532a4592652feaa74a34a912738b19508b0e7745eb4c78f1a23808b
SHA512

7d4e9c4f60c6105fc2135f2ec5b711673b6b48fbf026076baabf2824f986e20c7f92c40339820e103cf4f6d09b14b77d64281824c85159d09900f9257e92c5b8
SSDEEP

6144:rSD53NwySbOxBpCVIR3crDln4/XljIEOLmocOD/TjevCN29eJYvC:+D5dYbgTCVSADC/ljIEOSQbb298Y6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 4308	3288	regsvr32.exe	89
PID 3288 wrote to memory of 4308	3288	regsvr32.exe	89
PID 3288 wrote to memory of 4308	3288	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e5258f592532a4592652feaa74a34a912738b19508b0e7745eb4c78f1a23808b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e5258f592532a4592652feaa74a34a912738b19508b0e7745eb4c78f1a23808b.dll
  2⤵
  PID:4308