6450bc08a975462c463c0dc3fcf1b5634e1db6fd6c3a7f9a92ed3dd0aea42dc5

Analysis

max time kernel
80s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 23:18

Target

6450bc08a975462c463c0dc3fcf1b5634e1db6fd6c3a7f9a92ed3dd0aea42dc5.dll
Size

588KB
MD5

5462a4dd8ef42198158f56416d073b7a
SHA1

be26087141e5746ed1439a0411bb95591992d589
SHA256

6450bc08a975462c463c0dc3fcf1b5634e1db6fd6c3a7f9a92ed3dd0aea42dc5
SHA512

b6c3c4fa5debc5f617de75e7b3a1da0519872aace16a744ddf326388acfa96679e544847f45affd14d1bdccbdfaf99aaa24ff5bc15db5995df8066a8b2c24bce
SSDEEP

768:b58e3rRYY2uXZ9hAVaYUStKIZ+2fJcwqVETAz4HMBbsjjRGPZMo6/V:u9Y2IGM7IZ+nVETAzFs1fo+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 3096	2440	regsvr32.exe	79
PID 2440 wrote to memory of 3096	2440	regsvr32.exe	79
PID 2440 wrote to memory of 3096	2440	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6450bc08a975462c463c0dc3fcf1b5634e1db6fd6c3a7f9a92ed3dd0aea42dc5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6450bc08a975462c463c0dc3fcf1b5634e1db6fd6c3a7f9a92ed3dd0aea42dc5.dll
  2⤵
  PID:3096