f126dfd6bbdbaf0b29cc569bfeaae87041bdc246251db7352b116ac27855ce4f

Analysis

max time kernel
167s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 11:24

Target

f126dfd6bbdbaf0b29cc569bfeaae87041bdc246251db7352b116ac27855ce4f.dll
Size

588KB
MD5

e2dd1343afdd7d0f8930bce7feb65e0b
SHA1

5b3306e09cf2b7ef7c33923c9f10ad5a146e95c3
SHA256

f126dfd6bbdbaf0b29cc569bfeaae87041bdc246251db7352b116ac27855ce4f
SHA512

2e18a9fba2507417b0879910225e909694478750d260e5aa244d23c301f026ef726769dfbb63b618c81f37a50b9ae2a241a0d60ecb440e30a711ded177450f61
SSDEEP

768:7BRs43I9YY2uXZ9hAVa4mStKIZ+2fJcwqVETAz4HMBbsjjRGPZMo25CJV:vsYY2IGG7IZ+nVETAzFs1fo2wX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2348	2120	regsvr32.exe	81
PID 2120 wrote to memory of 2348	2120	regsvr32.exe	81
PID 2120 wrote to memory of 2348	2120	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f126dfd6bbdbaf0b29cc569bfeaae87041bdc246251db7352b116ac27855ce4f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f126dfd6bbdbaf0b29cc569bfeaae87041bdc246251db7352b116ac27855ce4f.dll
  2⤵
  PID:2348