c85d14e1a6afa43d497ab3ef6b0038247709743229d932e248c346f1b678e3c1

Analysis

max time kernel
189s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 05:09

Target

c85d14e1a6afa43d497ab3ef6b0038247709743229d932e248c346f1b678e3c1.dll
Size

588KB
MD5

bf292c4b8733fcec3e13afd8d9388fc0
SHA1

fd47c5708cfa5cc82860e674dc08c0b07699bc65
SHA256

c85d14e1a6afa43d497ab3ef6b0038247709743229d932e248c346f1b678e3c1
SHA512

bf21677fa6a5dd6d30847f2f4a03fe025315741120d76f03421ecffb3c1b649cb2b1756fb9e49f55e0a42bfa0622d79da90b7abab5f6c641adf5103468ee5899
SSDEEP

768:KS8e81YY2uXZ9hAVawuStKIZ+2fJcwqVETAz4HMBbsjjRGPZMoFpV:c6Y2IGe7IZ+nVETAzFs1foF3

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 972	2892	regsvr32.exe	83
PID 2892 wrote to memory of 972	2892	regsvr32.exe	83
PID 2892 wrote to memory of 972	2892	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c85d14e1a6afa43d497ab3ef6b0038247709743229d932e248c346f1b678e3c1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c85d14e1a6afa43d497ab3ef6b0038247709743229d932e248c346f1b678e3c1.dll
  2⤵
  PID:972