2646729f68e70324de240903fdfde8f027e3194596f8cc25c67a8e99f1b71804

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 13:38

Target

2646729f68e70324de240903fdfde8f027e3194596f8cc25c67a8e99f1b71804.dll
Size

20KB
MD5

0729159530643ba3b30874819491f341
SHA1

da320455d7323860f39598d516289e8a293a112f
SHA256

2646729f68e70324de240903fdfde8f027e3194596f8cc25c67a8e99f1b71804
SHA512

4fdd468850837f783c6b4764e8573a11cf8732047300f609b72ae73b982df80390bef57650eeada5e5d6dcbe187a4d4bfa43af2ec10e5f4fa18a1da7ad0fccc7
SSDEEP

384:2zWWTEcWweeQGaK+pdWvDRwWY73ZTFdRVYyKuLu4iSbwyo102umJIKV0mW:28lja+pdQRwFTXYyc41wzW2umJIKVg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 636	3404	regsvr32.exe	81
PID 3404 wrote to memory of 636	3404	regsvr32.exe	81
PID 3404 wrote to memory of 636	3404	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2646729f68e70324de240903fdfde8f027e3194596f8cc25c67a8e99f1b71804.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2646729f68e70324de240903fdfde8f027e3194596f8cc25c67a8e99f1b71804.dll
  2⤵
  PID:636