a38083f40aa0246d649233c2bdc038ff448598505edf31ada2bb7ff4e36f798c

Analysis

max time kernel
187s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 10:19

Target

a38083f40aa0246d649233c2bdc038ff448598505edf31ada2bb7ff4e36f798c.dll
Size

588KB
MD5

76ac1323f2f40d8189624835f014bf34
SHA1

5b50e334b33c5589d9e2426b8cb15766cca8f59b
SHA256

a38083f40aa0246d649233c2bdc038ff448598505edf31ada2bb7ff4e36f798c
SHA512

7174edb5b03f1855c3e8a6daec1029c2b518809694db931223edcd63bf7698579d8dc9707418d0a8f486e101a67dc5942ee7fcd1e1e1c3cb581fadf73b829544
SSDEEP

1536:CnUge63TC2tOmXbJVaK3R0XMJ33iU5hVXl7NeLZ61due6moMNNlltdgHXTzHrz08:QjTOubqoNNfob

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 1520	4084	regsvr32.exe	83
PID 4084 wrote to memory of 1520	4084	regsvr32.exe	83
PID 4084 wrote to memory of 1520	4084	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a38083f40aa0246d649233c2bdc038ff448598505edf31ada2bb7ff4e36f798c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a38083f40aa0246d649233c2bdc038ff448598505edf31ada2bb7ff4e36f798c.dll
  2⤵
  PID:1520