c9ccb7e4a9028dd9667fca7e83cde73108669097409c431f0be3aacb43cd4d8d

Analysis

max time kernel
90s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 22:37

Target

c9ccb7e4a9028dd9667fca7e83cde73108669097409c431f0be3aacb43cd4d8d.dll
Size

881KB
MD5

606cf2e7ba7a7f50038e0a07bf491710
SHA1

ee25769c8534e496d265b30a1187072e9c470be9
SHA256

c9ccb7e4a9028dd9667fca7e83cde73108669097409c431f0be3aacb43cd4d8d
SHA512

dc4988ff8353495373720585745d437846aa3ea7a00c391dfd3853154e824124218e6e5ebf5b636caedbb5317ebef8312063821cec8383734e5b0f782dd4ee76
SSDEEP

24576:oRTCAIL5zy+hgCY2C21h+hUlK0ZOG+l4kyrIkXE8nu:o4O+WCZCGlK0ZOGM4nIkXE8nu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 4312	1500	regsvr32.exe	82
PID 1500 wrote to memory of 4312	1500	regsvr32.exe	82
PID 1500 wrote to memory of 4312	1500	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c9ccb7e4a9028dd9667fca7e83cde73108669097409c431f0be3aacb43cd4d8d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c9ccb7e4a9028dd9667fca7e83cde73108669097409c431f0be3aacb43cd4d8d.dll
  2⤵
  PID:4312