d07cb442f1b95b159e93dcecf8049b777e6bd06926fdfd2b8e795f845c5b070d

Analysis

max time kernel
98s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 21:16

Target

d07cb442f1b95b159e93dcecf8049b777e6bd06926fdfd2b8e795f845c5b070d.dll
Size

23KB
MD5

d08f49fb068433e8cfc6e8bbd6b578e8
SHA1

6f916a64bd85b1e48a0878bbadadac88f2166d23
SHA256

d07cb442f1b95b159e93dcecf8049b777e6bd06926fdfd2b8e795f845c5b070d
SHA512

4cca01cef692464dd7fd386246d949b331c831747dd97d7a71a653fad0075ea17583609caacbf2fde7f3169656d9b0a698749b1e7db214179738cd19bc621e43
SSDEEP

384:XO9xz0CX0pqd+1ijQmZzdxVa3omF+3wbtP6iYwOmm7wdDAzBKmktc:+cCXEqdSQQS7SIgXYijdsBt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2032	2760	regsvr32.exe	80
PID 2760 wrote to memory of 2032	2760	regsvr32.exe	80
PID 2760 wrote to memory of 2032	2760	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d07cb442f1b95b159e93dcecf8049b777e6bd06926fdfd2b8e795f845c5b070d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d07cb442f1b95b159e93dcecf8049b777e6bd06926fdfd2b8e795f845c5b070d.dll
  2⤵
  PID:2032