f276c2c64b4d07caec9cc1a580d0fcc43ddeee2a8b3b2a3dd877df2f71edc95e

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 16:59

Target

f276c2c64b4d07caec9cc1a580d0fcc43ddeee2a8b3b2a3dd877df2f71edc95e.dll
Size

619KB
MD5

fbe44fd4369c0e9d5c9426260a613646
SHA1

48419adeaa791b8a8ee8b5b6b4bba1a21ddc9af7
SHA256

f276c2c64b4d07caec9cc1a580d0fcc43ddeee2a8b3b2a3dd877df2f71edc95e
SHA512

734dda5ed40f1d55cff55a95464db439abebf35541634bbc6fffcea7bb8ff5d300199c22705fd7b4e192816e40576412cdd1221eeea511bdc5968e0fe042bf08
SSDEEP

12288:8hhE59soLE8MdUSNFU4dZooEDfXKtocn7BnwAF:XkUSwmeoEDaS2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1424	1168	regsvr32.exe	80
PID 1168 wrote to memory of 1424	1168	regsvr32.exe	80
PID 1168 wrote to memory of 1424	1168	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f276c2c64b4d07caec9cc1a580d0fcc43ddeee2a8b3b2a3dd877df2f71edc95e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f276c2c64b4d07caec9cc1a580d0fcc43ddeee2a8b3b2a3dd877df2f71edc95e.dll
  2⤵
  PID:1424