12cb0135a60e77641a73c407e183d8b04c6534b1287fd1fc76407ae792d05d99

Analysis

max time kernel
174s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 04:41

Target

12cb0135a60e77641a73c407e183d8b04c6534b1287fd1fc76407ae792d05d99.dll
Size

132KB
MD5

722cc17c637e27e717f4080077edd490
SHA1

e9e58b974210b0b828ea7b28fe67deed323793d0
SHA256

12cb0135a60e77641a73c407e183d8b04c6534b1287fd1fc76407ae792d05d99
SHA512

1e9b543a4cf209700bb2bc37923d1452d0eb3e5c3e35cc96402d871d78dda1dde674cfc0bc17ee4d8066440c36fdaf82984356d8b7d82dc2089485e38c3cafce
SSDEEP

1536:P0MqqppQ+WQzYA2Yl8wsqfzIWpbdGtGU12zhv4I:8SOyV28+Kz+g42Nvt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 2148	4292	regsvr32.exe	81
PID 4292 wrote to memory of 2148	4292	regsvr32.exe	81
PID 4292 wrote to memory of 2148	4292	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\12cb0135a60e77641a73c407e183d8b04c6534b1287fd1fc76407ae792d05d99.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\12cb0135a60e77641a73c407e183d8b04c6534b1287fd1fc76407ae792d05d99.dll
  2⤵
  PID:2148