9e345b1e73f1e5ec6654d12eca1f20649cb80be69fe141723d966d3a2cdd0783

Analysis

max time kernel
257s
max time network
314s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 20:16

Target

9e345b1e73f1e5ec6654d12eca1f20649cb80be69fe141723d966d3a2cdd0783.dll
Size

128KB
MD5

fef0be069466859be6052d41890e1080
SHA1

078fa1ac33a14f259d50d42f4039a71f9180e68c
SHA256

9e345b1e73f1e5ec6654d12eca1f20649cb80be69fe141723d966d3a2cdd0783
SHA512

eeac262a75f93c2d0c69149f1567c73646458665bcc2be30d376f8b255202c6d4531d7399324b4ace621653849937f4ca163b6831dbdf0a4b5617f91c389ed2c
SSDEEP

1536:3mqvQVHXWRXjWm5YO6w9E3hy3FVhtoueZIbBz:N03WJjNuw9oo3F/CueZ8

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4452	4948	regsvr32.exe	81
PID 4948 wrote to memory of 4452	4948	regsvr32.exe	81
PID 4948 wrote to memory of 4452	4948	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9e345b1e73f1e5ec6654d12eca1f20649cb80be69fe141723d966d3a2cdd0783.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9e345b1e73f1e5ec6654d12eca1f20649cb80be69fe141723d966d3a2cdd0783.dll
  2⤵
  PID:4452