9cce6b8cc2737027180047d7d75007d146d59a48c96d675c7e55dc8d639c94db

Analysis

max time kernel
95s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 04:05

Target

9cce6b8cc2737027180047d7d75007d146d59a48c96d675c7e55dc8d639c94db.dll
Size

132KB
MD5

1dec6aaf0748a0b5885b68a57460de20
SHA1

3e7cee1b82af7e6a03372d9a76d34ad4f251d256
SHA256

9cce6b8cc2737027180047d7d75007d146d59a48c96d675c7e55dc8d639c94db
SHA512

9596fa95ecd6d77fb856e44db12e10eea21854947721ffe2f753eda3b48347944af2e626d7e8dfae4277e685ca664498212b7b3ba13ec5a8a29c659cff00e40b
SSDEEP

1536:+0MqqppQ+WQzYA2Yl8wNqfzIWpbdGtGU12zhv44:7SOyV28fKz+g42Nvt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 3220	4468	regsvr32.exe	80
PID 4468 wrote to memory of 3220	4468	regsvr32.exe	80
PID 4468 wrote to memory of 3220	4468	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9cce6b8cc2737027180047d7d75007d146d59a48c96d675c7e55dc8d639c94db.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9cce6b8cc2737027180047d7d75007d146d59a48c96d675c7e55dc8d639c94db.dll
  2⤵
  PID:3220