a48652c10d8676fedf663f3ea5abcf213c9ebefb7f0a543f16189dfed696089b

Analysis

max time kernel
195s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 16:10

Target

a48652c10d8676fedf663f3ea5abcf213c9ebefb7f0a543f16189dfed696089b.dll
Size

588KB
MD5

7f014066788bbe3f4f6addc6aebae72e
SHA1

0826540483c96e9f091d6f871409e7514f984f1f
SHA256

a48652c10d8676fedf663f3ea5abcf213c9ebefb7f0a543f16189dfed696089b
SHA512

8e934ed221f052c9a811b5ae2810ef6db44227e03bb0269629d686dda095e6bca7c4c3ad54acb5adbb3e15942a522f47bd1b7b30e70d00f91db995f36c44c4d1
SSDEEP

768:HlRs4+AOYY2uXZ9hAVawSStKIZ+2fJcwqVETAz4HMBbsjjRGPZMot6TCzV:PsiY2IG67IZ+nVETAzFs1fot62h

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 964	2160	regsvr32.exe	82
PID 2160 wrote to memory of 964	2160	regsvr32.exe	82
PID 2160 wrote to memory of 964	2160	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a48652c10d8676fedf663f3ea5abcf213c9ebefb7f0a543f16189dfed696089b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a48652c10d8676fedf663f3ea5abcf213c9ebefb7f0a543f16189dfed696089b.dll
  2⤵
  PID:964