c408cb6f64b3b7944a135b681a54acbe6c11159e109b423a5b85d3cdf2988698

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 09:44

Target

c408cb6f64b3b7944a135b681a54acbe6c11159e109b423a5b85d3cdf2988698.dll
Size

111KB
MD5

48726772be96c6e5a676afca78ea442e
SHA1

74a9b759e8dc1ccd69564c4857c9f15bd9e96c77
SHA256

c408cb6f64b3b7944a135b681a54acbe6c11159e109b423a5b85d3cdf2988698
SHA512

bf8b0c868855c2a00341924620bd213076fff8adb017943a4e1c4bd74a60a7772b2962504668696fe1efb9b84b051305f26f5b3b1bcc7a83484c728b6de08875
SSDEEP

1536:R5UfVZv6h9jo2rql+ERXuSclSFfL3eoxta2OMdj3KdQX:R5UP6hKRXuS6S9L3e2ta2OMdj3Ka

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 3404	848	regsvr32.exe	18
PID 848 wrote to memory of 3404	848	regsvr32.exe	18
PID 848 wrote to memory of 3404	848	regsvr32.exe	18

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c408cb6f64b3b7944a135b681a54acbe6c11159e109b423a5b85d3cdf2988698.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c408cb6f64b3b7944a135b681a54acbe6c11159e109b423a5b85d3cdf2988698.dll
  2⤵
  PID:3404