3fe110bded2b4bf2e8f9724a24aa83161b495d2ba9f659613be8dc4de4fe3f32

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 21:19

Target

3fe110bded2b4bf2e8f9724a24aa83161b495d2ba9f659613be8dc4de4fe3f32.dll
Size

332KB
MD5

035da6591abd2e9c5102440d9157d570
SHA1

40a8297f974121978e525481258d456e22ea878c
SHA256

3fe110bded2b4bf2e8f9724a24aa83161b495d2ba9f659613be8dc4de4fe3f32
SHA512

ab1d94804de128d943bb6dce3da79f59eb3b96252fa67c73102f3e1784c0a41961d41facf9efd8d0eb16bdb19c51c05e1ec0941dfd2ccbfa90dd752bcd8f1dd7
SSDEEP

6144:hqpaISLUCNlYIWXMPWEIDYE7yHzJyrMzDX+ir0wJTJonA3UEOktvA:hqpaISLUCNlYIW8PWEIDbyHzRDDYwBJw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4636	5044	regsvr32.exe	80
PID 5044 wrote to memory of 4636	5044	regsvr32.exe	80
PID 5044 wrote to memory of 4636	5044	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3fe110bded2b4bf2e8f9724a24aa83161b495d2ba9f659613be8dc4de4fe3f32.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3fe110bded2b4bf2e8f9724a24aa83161b495d2ba9f659613be8dc4de4fe3f32.dll
  2⤵
  PID:4636