faede3f2b4ece070767de2b111183683c1d4ecf2cf598b78335ce92f103f8259

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 05:13

Target

faede3f2b4ece070767de2b111183683c1d4ecf2cf598b78335ce92f103f8259.dll
Size

19KB
MD5

0a5f852d12710deedf7535ebd0afca70
SHA1

5b1db05004cbac69ee8b6577b3973200275dba07
SHA256

faede3f2b4ece070767de2b111183683c1d4ecf2cf598b78335ce92f103f8259
SHA512

3f7dcebd9f1244f5eb6b6fff2571a6f1e4ac18a439888275985e9f68fc8c34503ac818305ec121c94896bb49ca3a48776305d5d18f2019343312203ef0d7ebd1
SSDEEP

384:cWWTEcWjd55SolrDwjWU/mCNn49TkRBLoObb66Ij9Tfn7:3Zros4WUdy9TOLeTz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 4568	2328	regsvr32.exe	81
PID 2328 wrote to memory of 4568	2328	regsvr32.exe	81
PID 2328 wrote to memory of 4568	2328	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\faede3f2b4ece070767de2b111183683c1d4ecf2cf598b78335ce92f103f8259.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\faede3f2b4ece070767de2b111183683c1d4ecf2cf598b78335ce92f103f8259.dll
  2⤵
  PID:4568