2fd5e556a909f94ffb1e21de67e950dba6e3e8e1a7f64b121ae412166044900b

Analysis

max time kernel
186s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 19:12

Target

2fd5e556a909f94ffb1e21de67e950dba6e3e8e1a7f64b121ae412166044900b.dll
Size

1.2MB
MD5

ea2e2c6aa1f5cd7746c9eaafaf0d62f3
SHA1

81bac30327b2dd0ae5006b30b47940724431da31
SHA256

2fd5e556a909f94ffb1e21de67e950dba6e3e8e1a7f64b121ae412166044900b
SHA512

b5299406fe7608323fb18484879b38c6fdbbc2be6383acf4c146f9ffe1fce8accdcb8f2bce6d9adf92f9b8f3152390e284a16886af4e6d01bc10f57cbb78972b
SSDEEP

24576:avwTp/SfNAtwvazXyhZpwSNJH2/y4bYiJDZwchNIW2rdJxleqSi4vLTMm9LiDWyc:aSopPq9mw27a5tRdsUiE1Ll5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1936	1852	regsvr32.exe	83
PID 1852 wrote to memory of 1936	1852	regsvr32.exe	83
PID 1852 wrote to memory of 1936	1852	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2fd5e556a909f94ffb1e21de67e950dba6e3e8e1a7f64b121ae412166044900b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2fd5e556a909f94ffb1e21de67e950dba6e3e8e1a7f64b121ae412166044900b.dll
  2⤵
  PID:1936