224dbad36beaf8c59e1a9eb534568816019b4b53b51e21c283f481a24e26a4b8

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 00:36

Target

224dbad36beaf8c59e1a9eb534568816019b4b53b51e21c283f481a24e26a4b8.dll
Size

128KB
MD5

36673c8ce24b61621940435ff113bcb0
SHA1

65fdf4d0cd292a1e62ba530ce7f7eec4bd391dc5
SHA256

224dbad36beaf8c59e1a9eb534568816019b4b53b51e21c283f481a24e26a4b8
SHA512

4eb4d9d43c271b595e448c44cc6b2d7513d6b9f98dcc1e34e1ab8472a9e9f6fe5a6f35c62428dc33746c3abd4edef9424fe85103e55c48e90b01727e1cdf41da
SSDEEP

1536:NDfR/ho2LeV/dFPzmqiTyaDLhYETtyGqgo+XosUFmu1k6:NhhDeV/rPz7oqHGDo+XosUUu1k6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 4324	768	regsvr32.exe	81
PID 768 wrote to memory of 4324	768	regsvr32.exe	81
PID 768 wrote to memory of 4324	768	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\224dbad36beaf8c59e1a9eb534568816019b4b53b51e21c283f481a24e26a4b8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\224dbad36beaf8c59e1a9eb534568816019b4b53b51e21c283f481a24e26a4b8.dll
  2⤵
  PID:4324