75d88941966d53261005af1f0f42a24521cbd930bce4700b8b3e86962000b3ac

Analysis

max time kernel
100s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 13:09

Target

75d88941966d53261005af1f0f42a24521cbd930bce4700b8b3e86962000b3ac.dll
Size

128KB
MD5

5b96f1d16ae5830e21b3bdcdaf7fb981
SHA1

5b0f42355f31127feb32cfaa4d53bd8d7a101b04
SHA256

75d88941966d53261005af1f0f42a24521cbd930bce4700b8b3e86962000b3ac
SHA512

c63d9f6c023e2182b2c8606ef2d0a1f3ee5bd2cab19c5233d6ca2b9700943ffae4dbdd67898d51a2ca2ae397d714c14a2d6afcfb71e3d281908742df1be08415
SSDEEP

1536:/UgJ+bTg2rWyvmULwsQqdnITBNQIZnCLzs3A6:/OrWyv7wc8iItCLzs3H

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 2528	4768	regsvr32.exe	82
PID 4768 wrote to memory of 2528	4768	regsvr32.exe	82
PID 4768 wrote to memory of 2528	4768	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\75d88941966d53261005af1f0f42a24521cbd930bce4700b8b3e86962000b3ac.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\75d88941966d53261005af1f0f42a24521cbd930bce4700b8b3e86962000b3ac.dll
  2⤵
  PID:2528