ad653ec99785511e29f43685dfd8ea7b4c882f0c0d7ba5b6db8de5703b96f05e

Analysis

max time kernel
187s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 03:20

Target

ad653ec99785511e29f43685dfd8ea7b4c882f0c0d7ba5b6db8de5703b96f05e.dll
Size

186KB
MD5

6d554667ce3e78a622d2159e6508a006
SHA1

ce715bb8e3af0e6446ca92a3deb000487cd4ccdb
SHA256

ad653ec99785511e29f43685dfd8ea7b4c882f0c0d7ba5b6db8de5703b96f05e
SHA512

6096a28261c784a94d06a5397549793ba71ea64465a6df004cf995eb0a15228152a315073c968629bf2edfe2a7b7bcec7d27db4f1267c4c5e1f2a0da1b1511a2
SSDEEP

3072:6hjTY5+hjTY5+hjTY5+hjTY5+hjTY5+hjTY5:6lThlThlThlThlThlT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 4584	4332	regsvr32.exe	82
PID 4332 wrote to memory of 4584	4332	regsvr32.exe	82
PID 4332 wrote to memory of 4584	4332	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ad653ec99785511e29f43685dfd8ea7b4c882f0c0d7ba5b6db8de5703b96f05e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ad653ec99785511e29f43685dfd8ea7b4c882f0c0d7ba5b6db8de5703b96f05e.dll
  2⤵
  PID:4584