082ca286da5ed5acf2f340aa81fdb90de451e9991bf8fe6d4a6cd1389bb036df

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2022 21:35

Target

082ca286da5ed5acf2f340aa81fdb90de451e9991bf8fe6d4a6cd1389bb036df.dll
Size

124KB
MD5

077523b791c0b783fa38fd78c21c28d0
SHA1

24840844a16e5d773e747fa5a35d2e082a5c9196
SHA256

082ca286da5ed5acf2f340aa81fdb90de451e9991bf8fe6d4a6cd1389bb036df
SHA512

e471fa79dbf178a016c48f3c6a27da422eccea067bf489b4b5a1d792aea846b81b6ce4fa6d8ccbaa43ebe75c27cf6df3783135707a3d7adb372deedca81767f0
SSDEEP

3072:evBCKnP0upYMO8QBDZdlWT8lbny92zjKqll:EC6YMO8cZTWTybnvPrX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 1816	5000	regsvr32.exe	80
PID 5000 wrote to memory of 1816	5000	regsvr32.exe	80
PID 5000 wrote to memory of 1816	5000	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\082ca286da5ed5acf2f340aa81fdb90de451e9991bf8fe6d4a6cd1389bb036df.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\082ca286da5ed5acf2f340aa81fdb90de451e9991bf8fe6d4a6cd1389bb036df.dll
  2⤵
  PID:1816