ac53ad7f5aa51958f6b2177271a7cc32e6d6ab60c7a4d344b4c5c00244db036e

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 13:23

Target

ac53ad7f5aa51958f6b2177271a7cc32e6d6ab60c7a4d344b4c5c00244db036e.dll
Size

196KB
MD5

62b0a37ed6dc8ea1ed607c384f8dbabb
SHA1

48b300b448f43572e1bbbca44aa98bb210fb6aa1
SHA256

ac53ad7f5aa51958f6b2177271a7cc32e6d6ab60c7a4d344b4c5c00244db036e
SHA512

111c8958b2d2f16040c810eabf238dceb172e753054b1966000cbac6fb3afeb83d5d55239ee36ccbbe9673b9a9a2e83a002f513946caae66f087411788c37843
SSDEEP

6144:jYJ4S0Qmn675xHu5nsMJqS/Mmc0TkkRsknTVD:G4S0Qmn675xHu5C+M075R

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 3464	4996	regsvr32.exe	81
PID 4996 wrote to memory of 3464	4996	regsvr32.exe	81
PID 4996 wrote to memory of 3464	4996	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ac53ad7f5aa51958f6b2177271a7cc32e6d6ab60c7a4d344b4c5c00244db036e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ac53ad7f5aa51958f6b2177271a7cc32e6d6ab60c7a4d344b4c5c00244db036e.dll
  2⤵
  PID:3464