cdc97253ce3d9edc76be13f6ef845437339587fa1e204dbc013285fed4700c20

Analysis

max time kernel
142s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 12:51

Target

cdc97253ce3d9edc76be13f6ef845437339587fa1e204dbc013285fed4700c20.dll
Size

128KB
MD5

36f80bb4b565565b4b34a296e73ff34f
SHA1

465178a2dc766ab5c27a555b2f8eabb51aa29d1c
SHA256

cdc97253ce3d9edc76be13f6ef845437339587fa1e204dbc013285fed4700c20
SHA512

3cbca8ea8db81ea3313ed604d941c399a479b9da90d052f109158aebe2cce760b6509ddd7c79874c1071039d8d920ea9045cd35ad5c368fe13ad94d8c104fa0c
SSDEEP

1536:0mUgJ+TpTC2tOmXbJVaK3R0XMJ33iU5hVXl7NeLZ61due6moMNNlltdgHXTzHrzF:vQTOubqoNNfo/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 2276	1532	regsvr32.exe	80
PID 1532 wrote to memory of 2276	1532	regsvr32.exe	80
PID 1532 wrote to memory of 2276	1532	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cdc97253ce3d9edc76be13f6ef845437339587fa1e204dbc013285fed4700c20.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cdc97253ce3d9edc76be13f6ef845437339587fa1e204dbc013285fed4700c20.dll
  2⤵
  PID:2276