cfa63699e41a8e32e99c14b9cd7d0937a9b60cd28f1aeac029df6b7f392d6888

Analysis

max time kernel
140s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 20:11

Target

cfa63699e41a8e32e99c14b9cd7d0937a9b60cd28f1aeac029df6b7f392d6888.dll
Size

120KB
MD5

6fd938e8dc821766e06a72d25cb6b090
SHA1

e7075bfc3770c11e0949ddedc9617c7981cfd118
SHA256

cfa63699e41a8e32e99c14b9cd7d0937a9b60cd28f1aeac029df6b7f392d6888
SHA512

adb64bd1c770c5cc64552b5cfc399efe96c2b0aa942c99e3f523370ee16632ce0d99cdee5763aa0140522206e529e5370027068944091dff5e82f304425ecab6
SSDEEP

768:w5tayhq4QC+IcV4bbVPt8+5bKi5OZvdczmwwRUsWLN45YmvOHuZjdAWwCSXBJeUA:Yhq4Qcemp3z5OZLUF45TOShAuSxJe9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 2084	4644	regsvr32.exe	79
PID 4644 wrote to memory of 2084	4644	regsvr32.exe	79
PID 4644 wrote to memory of 2084	4644	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cfa63699e41a8e32e99c14b9cd7d0937a9b60cd28f1aeac029df6b7f392d6888.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cfa63699e41a8e32e99c14b9cd7d0937a9b60cd28f1aeac029df6b7f392d6888.dll
  2⤵
  PID:2084