4aa1c77f7a603a7d3760ff49a5f53a309e87369e63a06f6a6e8ccc1e8ff53eac

Analysis

max time kernel
90s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2022 10:51

Target

4aa1c77f7a603a7d3760ff49a5f53a309e87369e63a06f6a6e8ccc1e8ff53eac.dll
Size

796KB
MD5

e44c42a73c934c303d0785e761c0c2f0
SHA1

fa20882d455b1b0a516687cddbea6977ab5650c0
SHA256

4aa1c77f7a603a7d3760ff49a5f53a309e87369e63a06f6a6e8ccc1e8ff53eac
SHA512

4f1799438d9dd01d6ef13fb69bf5da7cbdb17e9ea4024ea492d7595756a48c34c9cf49db0ef36edfec9c7ca36f38762c832474ba46c9c59bc43092ff1706b545
SSDEEP

12288:HKp0fMRb6+IpOev/Nhth8EFBppcw36KWZrQ:HKqM4ge9RJ3ppcsx4r

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 528	4876	regsvr32.exe	81
PID 4876 wrote to memory of 528	4876	regsvr32.exe	81
PID 4876 wrote to memory of 528	4876	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4aa1c77f7a603a7d3760ff49a5f53a309e87369e63a06f6a6e8ccc1e8ff53eac.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4aa1c77f7a603a7d3760ff49a5f53a309e87369e63a06f6a6e8ccc1e8ff53eac.dll
  2⤵
  PID:528