273217e6d95d45a441e7df9a371618418df0ccdc7355a693130d1c569b6be70b

Analysis

max time kernel
178s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 03:01

Target

273217e6d95d45a441e7df9a371618418df0ccdc7355a693130d1c569b6be70b.dll
Size

56KB
MD5

2ca84a5e9af0d396c7fdf9379c951ff5
SHA1

a42fcbec598be436c45b15e4f93c2720d2e5c63e
SHA256

273217e6d95d45a441e7df9a371618418df0ccdc7355a693130d1c569b6be70b
SHA512

a7c5281178868d67301cf610e5c8c81dc7bd2eca56b20b964d2d046eaf188123396facfba1b6fd97b577f0cdf392ce9f8360afba4a5786350b08de62c12ff6d3
SSDEEP

1536:g0qiQWEVy27b0RJOT6wdEiHCj/GV/1uR/043:Bmg27b0LtlAV/1uRs43

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 4288	1792	regsvr32.exe	81
PID 1792 wrote to memory of 4288	1792	regsvr32.exe	81
PID 1792 wrote to memory of 4288	1792	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\273217e6d95d45a441e7df9a371618418df0ccdc7355a693130d1c569b6be70b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\273217e6d95d45a441e7df9a371618418df0ccdc7355a693130d1c569b6be70b.dll
  2⤵
  PID:4288