c2aed14aa68c1d0fb64e5c7d52af82f72e2a310c96fbe7a1e561721cd1f2c98b

Analysis

max time kernel
112s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 05:42

Target

c2aed14aa68c1d0fb64e5c7d52af82f72e2a310c96fbe7a1e561721cd1f2c98b.dll
Size

128KB
MD5

d354a5a84f2dcbbe6664c89e3c5cb14e
SHA1

a6182223c3fd15c9b490b47156a91ba4de1fcc40
SHA256

c2aed14aa68c1d0fb64e5c7d52af82f72e2a310c96fbe7a1e561721cd1f2c98b
SHA512

f92247012aa08d9043d01786e2e41c048630996a7dbc0e7c7e5ad0d7c571410ad15050bdf2e39e84044a5f2ff4e50030766c6cacf5446d9f3ba9fba7eb98755a
SSDEEP

1536:GUgJ+bag2rWyvmULwsQqdnITBNQIZnCLzsNA6:GvrWyv7wc8iItCLzsNH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 3628	3540	regsvr32.exe	82
PID 3540 wrote to memory of 3628	3540	regsvr32.exe	82
PID 3540 wrote to memory of 3628	3540	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c2aed14aa68c1d0fb64e5c7d52af82f72e2a310c96fbe7a1e561721cd1f2c98b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c2aed14aa68c1d0fb64e5c7d52af82f72e2a310c96fbe7a1e561721cd1f2c98b.dll
  2⤵
  PID:3628