c75197d845097c3449a4ba4ec8480ae2ba5009949c4727363ef7627f50983f29

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 23:42

Target

c75197d845097c3449a4ba4ec8480ae2ba5009949c4727363ef7627f50983f29.dll
Size

52KB
MD5

692241dd119ee988defb4c49fc64fe40
SHA1

4194c7de9c1a3614a23f13f1c02858ae1c38d443
SHA256

c75197d845097c3449a4ba4ec8480ae2ba5009949c4727363ef7627f50983f29
SHA512

0698dbbaf439575776dbd4675bd0b54e187bf87e89a0190db4e7b4ed65687d01f4814d55609831dffc967ed4c7392d0786fe749afc2b0fbcf9f613df77cd6ff1
SSDEEP

1536:JYV33vPzLaLePtYLVNG3vAGDO1Tn5wEKijQfQ06LOg6c/:+Vv3GLCVD+ZKijozoOzc/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4376	4872	regsvr32.exe	82
PID 4872 wrote to memory of 4376	4872	regsvr32.exe	82
PID 4872 wrote to memory of 4376	4872	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c75197d845097c3449a4ba4ec8480ae2ba5009949c4727363ef7627f50983f29.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c75197d845097c3449a4ba4ec8480ae2ba5009949c4727363ef7627f50983f29.dll
  2⤵
  PID:4376