90dad8c764a0847d6bf32b1adfb3457e390f799c756bf914bae00ffec841fdd7

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 20:47

Target

90dad8c764a0847d6bf32b1adfb3457e390f799c756bf914bae00ffec841fdd7.dll
Size

120KB
MD5

776454642ceeb9dbaca0e72050ff18e0
SHA1

9730933724af21b8e411c00c7fdc5dce11a44fe1
SHA256

90dad8c764a0847d6bf32b1adfb3457e390f799c756bf914bae00ffec841fdd7
SHA512

76ec3c34ccf65b860bd2c3891520b9d0078d3f1253e9f1218a140330ee64c2f2b5387e17004722eefd889ed4f8d0481cfbae941ea2ef5fba1675c07ce6e6d808
SSDEEP

1536:wlqcQf8EVmtoAap73Q+jZsVsiuxnf2j1Dezys:Ow8Eyrap8YsVfuxfY1iGs

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 1436	5036	regsvr32.exe	79
PID 5036 wrote to memory of 1436	5036	regsvr32.exe	79
PID 5036 wrote to memory of 1436	5036	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\90dad8c764a0847d6bf32b1adfb3457e390f799c756bf914bae00ffec841fdd7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\90dad8c764a0847d6bf32b1adfb3457e390f799c756bf914bae00ffec841fdd7.dll
  2⤵
  PID:1436