890ebcc73f6b737164627b260daa533e79cb282ff95c85b0f1219099a68f294d

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 21:38

Target

890ebcc73f6b737164627b260daa533e79cb282ff95c85b0f1219099a68f294d.dll
Size

588KB
MD5

5500ae19f61840753f2178c02878940d
SHA1

c4e1552b7743a712d879b0f0745732ef72671e8f
SHA256

890ebcc73f6b737164627b260daa533e79cb282ff95c85b0f1219099a68f294d
SHA512

40ba2042bac4bbe784f1a79db015b07f41476f382a42b84610eaf8bc6272c5942944855a74c3fdf50d8398ca9510e9a35589a9d4eb0bf601b9f4cb82e8bfe3ed
SSDEEP

768:K58e3r9YY2uXZ9hAVaYUStKIZ+2fJcwqVETAz4HMBbsjjRGPZMoE/V:BpY2IGM7IZ+nVETAzFs1foM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4292	4776	regsvr32.exe	80
PID 4776 wrote to memory of 4292	4776	regsvr32.exe	80
PID 4776 wrote to memory of 4292	4776	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\890ebcc73f6b737164627b260daa533e79cb282ff95c85b0f1219099a68f294d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\890ebcc73f6b737164627b260daa533e79cb282ff95c85b0f1219099a68f294d.dll
  2⤵
  PID:4292