d82e77e365b2f2932873156835a560524aeb4dca71569a6d93254ecbba529afb

Analysis

max time kernel
90s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 13:36 UTC

Target

d82e77e365b2f2932873156835a560524aeb4dca71569a6d93254ecbba529afb.dll
Size

276KB
MD5

f7fa40353dc26ef6ab41e3bdc3fb960d
SHA1

c1c9c8746e4d8306d99372b3d90119a213bf831e
SHA256

d82e77e365b2f2932873156835a560524aeb4dca71569a6d93254ecbba529afb
SHA512

d5210971e67ec33e90a8a792f4eea4c3f7ab852b6e8b25d8ea67b9c10b77c249a9f54af3e497925108dde05b5fd6589baad7a8c9b68dd742163936dc58bd94e8
SSDEEP

6144:7EmSpAuZ4RWJYn8tED0weBYMgl3lMu1k7:7EmOAuZXWnCEiBYMgll1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 3192	4376	regsvr32.exe	81
PID 4376 wrote to memory of 3192	4376	regsvr32.exe	81
PID 4376 wrote to memory of 3192	4376	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d82e77e365b2f2932873156835a560524aeb4dca71569a6d93254ecbba529afb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d82e77e365b2f2932873156835a560524aeb4dca71569a6d93254ecbba529afb.dll
  2⤵
  PID:3192