04ac13d3055cef4bdbc8d18acd84ac4b15723540272940c742e0cdd82600150f

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 16:16

Target
04ac13d3055cef4bdbc8d18acd84ac4b15723540272940c742e0cdd82600150f.dll
Size 371KB
Sample221203-tq9jvsfa92
SHA256 04ac13d3055cef4bdbc8d18acd84ac4b15723540272940c742e0cdd82600150f
MD5 dd13d5390d4daff91e3ce096e82296c0
SHA1 41fde56e0fe39cca8240d6bff002b7e0f41bec9f
SHA512 c1f5148da53497860b781f2a3e1bf32bbe9164dbaceda69f257d0ae07ebb52dd22466082979ec032a8a14aa214430e2878701b60eac2ecd3315a4326cfee975a
SSDEEP 3072:3yZBI+Hfx7g5oOuomedIq2bXRGD+EpPMubDiSdYYOU7bOyEoSO/roQtCcn7Xwz:3efWJbm1q2bXRGaEuubDzdBOU7BHwz
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 2132	3964	regsvr32.exe	83
PID 3964 wrote to memory of 2132	3964	regsvr32.exe	83
PID 3964 wrote to memory of 2132	3964	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\04ac13d3055cef4bdbc8d18acd84ac4b15723540272940c742e0cdd82600150f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\04ac13d3055cef4bdbc8d18acd84ac4b15723540272940c742e0cdd82600150f.dll
  2⤵
  PID:2132