b6a5edd15ccddce0bff67cca4b441cda66c97441c365a4134f87dc6212874c43

Analysis

max time kernel
285s
max time network
341s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 06:48

Target

b6a5edd15ccddce0bff67cca4b441cda66c97441c365a4134f87dc6212874c43.dll
Size

208KB
MD5

0b459ce42094a5210db40b38f84774f0
SHA1

4b754796395a8fd7d2151bb041e586936d2a6e65
SHA256

b6a5edd15ccddce0bff67cca4b441cda66c97441c365a4134f87dc6212874c43
SHA512

af7263a80f06405c1e0d9e6d68a098e3c2869ff7ed34ffa5b70d75d54dff20ea50e4c18a36d8dea25eae2404091e0458c435805292c0a9c12fb67b2fe1e23654
SSDEEP

1536:NE/D+zqWEaDaJuwqjqSYGhRiyfuky+k0wqjqSYGhRiyf0:/qWBOJEq5GTvuk7kyq5GTv0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 1944	4436	regsvr32.exe	84
PID 4436 wrote to memory of 1944	4436	regsvr32.exe	84
PID 4436 wrote to memory of 1944	4436	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b6a5edd15ccddce0bff67cca4b441cda66c97441c365a4134f87dc6212874c43.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b6a5edd15ccddce0bff67cca4b441cda66c97441c365a4134f87dc6212874c43.dll
  2⤵
  PID:1944