a24ea3194fbe39e6210b92a6af387fcd9cba04aa12ab893ce3749620c6979fb6

Analysis

max time kernel
293s
max time network
335s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 04:15

Target

a24ea3194fbe39e6210b92a6af387fcd9cba04aa12ab893ce3749620c6979fb6.dll
Size

588KB
MD5

41854ff5b13e48486bfdd43e52f83b9e
SHA1

ef9562dd53627e7fd2bb5b1be1c4da4722f8e9ba
SHA256

a24ea3194fbe39e6210b92a6af387fcd9cba04aa12ab893ce3749620c6979fb6
SHA512

f4f93e0e49e38af1f2fd56328ca01f313bd17f30c6dcab70ce922b7a0550a19425445943e41f98d207c824af101011448fb597c08cf234ff77ff4bc3db04dfe7
SSDEEP

768:i58e3rqYY2uXZ9hAVaYUStKIZ+2fJcwqVETAz4HMBbsjjRGPZMoc/V:5mY2IGM7IZ+nVETAzFs1fo0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 3016	1904	regsvr32.exe	80
PID 1904 wrote to memory of 3016	1904	regsvr32.exe	80
PID 1904 wrote to memory of 3016	1904	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a24ea3194fbe39e6210b92a6af387fcd9cba04aa12ab893ce3749620c6979fb6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a24ea3194fbe39e6210b92a6af387fcd9cba04aa12ab893ce3749620c6979fb6.dll
  2⤵
  PID:3016