a66b9e02ae7bd9a89669c482295e25ea00d87e4b08ccb1668469208f97d65fbe

Analysis

max time kernel
112s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 20:02

Target

a66b9e02ae7bd9a89669c482295e25ea00d87e4b08ccb1668469208f97d65fbe.dll
Size

588KB
MD5

4ec2adb9fdc9b763fdbde846633aff55
SHA1

48bc3c65a20154c4660273742d5f52b892353112
SHA256

a66b9e02ae7bd9a89669c482295e25ea00d87e4b08ccb1668469208f97d65fbe
SHA512

0d6818db8ae600f71aa72ad3a8d791b13ac6ca3605cf8bd6f888834496751afe85fb89b12f8d792c4baea9b3a43b095ca1df6ba835c35b21e01308ec806f11b8
SSDEEP

768:FAI9UI1cq0WxG0T2d2hXZq/oCT6Uv2h3PNnVftA2oT4qVx4nX9iAVRGPZMo7zR0/:u2UgeCFTC2tO2UOJN82oT4qoN5Tfou/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4960	4976	regsvr32.exe	81
PID 4976 wrote to memory of 4960	4976	regsvr32.exe	81
PID 4976 wrote to memory of 4960	4976	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a66b9e02ae7bd9a89669c482295e25ea00d87e4b08ccb1668469208f97d65fbe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a66b9e02ae7bd9a89669c482295e25ea00d87e4b08ccb1668469208f97d65fbe.dll
  2⤵
  PID:4960