f93aef709ae8779ad7644a1ee67c9dc51333d14fd4809fc58cb79b393460cb64

Analysis

max time kernel
106s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 11:06

Target

f93aef709ae8779ad7644a1ee67c9dc51333d14fd4809fc58cb79b393460cb64.dll
Size

116KB
MD5

3d11dd6375f6f3336cafa7876cbba033
SHA1

749ed0c5764832d8a8b7a1c2b0ee965312d63b5d
SHA256

f93aef709ae8779ad7644a1ee67c9dc51333d14fd4809fc58cb79b393460cb64
SHA512

185b4258fc85574a0d5587dd5c9061fe5a56180652ec461935f4325bba622b64cc889b03821da3a76f9d5f02a58c57b4f7cae9eac1d91808f7b6841abe2c998c
SSDEEP

768:Qb/hBQoi5qZO3QOSxodaCbR2Ala562sIJLwYk6R+Qbii/zyMZ/OPdGVs1CWd:C/jQv5qZWQ4NnYPhMFi/zfZWVGVs1r

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 2004	3908	regsvr32.exe	77
PID 3908 wrote to memory of 2004	3908	regsvr32.exe	77
PID 3908 wrote to memory of 2004	3908	regsvr32.exe	77

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f93aef709ae8779ad7644a1ee67c9dc51333d14fd4809fc58cb79b393460cb64.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f93aef709ae8779ad7644a1ee67c9dc51333d14fd4809fc58cb79b393460cb64.dll
  2⤵
  PID:2004