dcf4d8e9b5f3b1665483e603f974f5740ac3345105ea709cf2e73ec376bd77c7

Analysis

max time kernel
91s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 20:49

Target

dcf4d8e9b5f3b1665483e603f974f5740ac3345105ea709cf2e73ec376bd77c7.dll
Size

132KB
MD5

71fdc473252067e7495e14c2a9341c90
SHA1

271f83c09ef47242288c5320751c488cd2d0473d
SHA256

dcf4d8e9b5f3b1665483e603f974f5740ac3345105ea709cf2e73ec376bd77c7
SHA512

eac62d7f70aee2ec9962acaf3b40ad8f1397ace91f87fd055bd90490ec7f947b26f0cc53bcbe4cdcdb794c14b4ca3e429f9671cbb1945014fb1442856a3d6cf6
SSDEEP

1536:7AMq1pUQ25MTaopejcTx/qkjIHR29TXNDx:0o52npeoIMIx29TD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 3180	4180	regsvr32.exe	81
PID 4180 wrote to memory of 3180	4180	regsvr32.exe	81
PID 4180 wrote to memory of 3180	4180	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dcf4d8e9b5f3b1665483e603f974f5740ac3345105ea709cf2e73ec376bd77c7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dcf4d8e9b5f3b1665483e603f974f5740ac3345105ea709cf2e73ec376bd77c7.dll
  2⤵
  PID:3180