cd2a21ee263462041bb592152b381d6b282521e0374dc1bd42ba5ef11a93d913

Analysis

max time kernel
166s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 05:34

Target

cd2a21ee263462041bb592152b381d6b282521e0374dc1bd42ba5ef11a93d913.dll
Size

156KB
MD5

59e5807b4a00352547aa6bc32409f423
SHA1

0e59343241077a80922cca81bba9b6f572bc2aca
SHA256

cd2a21ee263462041bb592152b381d6b282521e0374dc1bd42ba5ef11a93d913
SHA512

71fbd2a5daf5a20020b8e976448cf93417ca5dcbd0efff84e29cf0dccd1da89d481aca433960ba2bb82f04387ea365f6308d9c06c9377efb489c1f3acbe31694
SSDEEP

1536:PB+FpymXELWsmKVy2ipO8MPzZqsTpoQPYSV2KHW9apVrICS4ASilQogLae0XiK:Z+X3XEi+SyqVzVAeQozZX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 3924	2180	regsvr32.exe	82
PID 2180 wrote to memory of 3924	2180	regsvr32.exe	82
PID 2180 wrote to memory of 3924	2180	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cd2a21ee263462041bb592152b381d6b282521e0374dc1bd42ba5ef11a93d913.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cd2a21ee263462041bb592152b381d6b282521e0374dc1bd42ba5ef11a93d913.dll
  2⤵
  PID:3924