d4c0fe30aac956837ea431f6b1b03d4410e7ae04bfa4620ea4406f725aef7b8f

Analysis

max time kernel
183s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 23:43

Target

d4c0fe30aac956837ea431f6b1b03d4410e7ae04bfa4620ea4406f725aef7b8f.dll
Size

144KB
MD5

21cb100b5bca2a4f93f93ce484407f62
SHA1

0516005844feb68ebf3e7d37ae169e26dc1eb6e2
SHA256

d4c0fe30aac956837ea431f6b1b03d4410e7ae04bfa4620ea4406f725aef7b8f
SHA512

e7335563b588d5e2c5b9380c5f24e2a8ce7cf53440f586481cb3b8f0d1488a9fa88f4f0abe946e654fc22ef3e28c11a1b861cfe6af0341e796827975b44ac033
SSDEEP

3072:BMC7wyUd+8W3RefHVgztWggo+ALEuNsIzQUGk6qlgO:BwyUQ8WyTDqLNsIzQlkfl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 816	4960	regsvr32.exe	81
PID 4960 wrote to memory of 816	4960	regsvr32.exe	81
PID 4960 wrote to memory of 816	4960	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d4c0fe30aac956837ea431f6b1b03d4410e7ae04bfa4620ea4406f725aef7b8f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d4c0fe30aac956837ea431f6b1b03d4410e7ae04bfa4620ea4406f725aef7b8f.dll
  2⤵
  PID:816