9e14ab3d75ec0cb0019646ff6d79b65142c7e6aaf6d556294e888629564794c1

Analysis

max time kernel
177s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 03:04

Target

9e14ab3d75ec0cb0019646ff6d79b65142c7e6aaf6d556294e888629564794c1.dll
Size

904KB
MD5

6a1d004ae163b188a493056b38da2c40
SHA1

56a66a10113dd2d779f6a47e164282e5bfb03702
SHA256

9e14ab3d75ec0cb0019646ff6d79b65142c7e6aaf6d556294e888629564794c1
SHA512

03c0c46c2aa93a70c765204d887dc7ce2234e39a03bae84233f498d61add04e7234055892f392b66a7deb37fcf7df6e410a9b19a58e32579722ad19c94355a72
SSDEEP

12288:SSVD4fbEN2h/A22b+ierYiSEQxfF705s0v77wrKTMoJEhn9:Su4f4N2xIEDQhF705s0v77iKT5O

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\regsvr32.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 3168	4464	regsvr32.exe	86
PID 4464 wrote to memory of 3168	4464	regsvr32.exe	86
PID 4464 wrote to memory of 3168	4464	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9e14ab3d75ec0cb0019646ff6d79b65142c7e6aaf6d556294e888629564794c1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9e14ab3d75ec0cb0019646ff6d79b65142c7e6aaf6d556294e888629564794c1.dll
  2⤵
  - Drops file in System32 directory
  PID:3168