99126f049f918508672d8905b87f6629201b72eec9578166ac973f39f1becc25

Analysis

max time kernel
63s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 02:41

Target

99126f049f918508672d8905b87f6629201b72eec9578166ac973f39f1becc25.dll
Size

436KB
MD5

4cbb1126636d1d61bb1d884964c3c400
SHA1

0b9d69597304edd7d6abe4ff878b61ea17f3ee5d
SHA256

99126f049f918508672d8905b87f6629201b72eec9578166ac973f39f1becc25
SHA512

a30676e4d457a1732fd723d8a1002f892331da4420d2a27f0e0506f39e565a6eadc5e95c2a90003d2051266cd94473ad9e9584c4f1a0497aa9ec9a23afac3cfc
SSDEEP

6144:YG4cvRprRSvftI3gwK1lBrOldXWEA7d1D1LL2JqnAA31ZiWG3A3JMr+mtt4/3Lnr:YWeI3gwU5d1B1nHZdH3JMaLHb3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2488	2976	regsvr32.exe	82
PID 2976 wrote to memory of 2488	2976	regsvr32.exe	82
PID 2976 wrote to memory of 2488	2976	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\99126f049f918508672d8905b87f6629201b72eec9578166ac973f39f1becc25.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\99126f049f918508672d8905b87f6629201b72eec9578166ac973f39f1becc25.dll
  2⤵
  PID:2488