c03e0191f33214143fe89260534f14a9b212848441f409cb47891bc66fa5f2a8

Analysis

max time kernel
123s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 07:43

Target

c03e0191f33214143fe89260534f14a9b212848441f409cb47891bc66fa5f2a8.dll
Size

425KB
MD5

b208006d71d7e1c2d0483188146b2f12
SHA1

12ceb0ce0f8651d767b13cc7bfbfb03caa2ac611
SHA256

c03e0191f33214143fe89260534f14a9b212848441f409cb47891bc66fa5f2a8
SHA512

711e339c56f681ed671caca750f09abc9d08e493e13fc8aa731384e80861536b0a484d249449db6635f3f01bc2938bd2bcf12dc706f80d04ac0b25d2042d6a68
SSDEEP

12288:dC1umhYTWob3UpvsMrngCdBF+eIZo8sT3:muXWob3Uzngk/IGBr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 4940	5052	regsvr32.exe	82
PID 5052 wrote to memory of 4940	5052	regsvr32.exe	82
PID 5052 wrote to memory of 4940	5052	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c03e0191f33214143fe89260534f14a9b212848441f409cb47891bc66fa5f2a8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c03e0191f33214143fe89260534f14a9b212848441f409cb47891bc66fa5f2a8.dll
  2⤵
  PID:4940