9e1ae35ac7a7e4b148b1e56c26d35c8608fb441cd9f25ad99ecd8d26c78778e1

Analysis

max time kernel
196s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 11:23

Target

9e1ae35ac7a7e4b148b1e56c26d35c8608fb441cd9f25ad99ecd8d26c78778e1.dll
Size

144KB
MD5

c27e0ed667f04c540f47feae2587c0b0
SHA1

a91e2d8927fb83203c3dc710be1b2cd0068b666a
SHA256

9e1ae35ac7a7e4b148b1e56c26d35c8608fb441cd9f25ad99ecd8d26c78778e1
SHA512

52ad7f47ebceb853d26c2775e5b0cbd79252b3af205c7443e3691486adf20b58cb6300d6a1082158c72df82147595537c9dae98dce2bbfc6e7be7b7844b38df2
SSDEEP

3072:qzNn/yTZtVv8mexZpYSxvv7romYJ4nyBqmssuxSxfOcGuZ:qzN/qV0pNzrCssux8fW2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1140	1712	regsvr32.exe	81
PID 1712 wrote to memory of 1140	1712	regsvr32.exe	81
PID 1712 wrote to memory of 1140	1712	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9e1ae35ac7a7e4b148b1e56c26d35c8608fb441cd9f25ad99ecd8d26c78778e1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9e1ae35ac7a7e4b148b1e56c26d35c8608fb441cd9f25ad99ecd8d26c78778e1.dll
  2⤵
  PID:1140