f8cc81353a4edfc4bbf252b1a1651e9572247e9cf2fc178663e3823cc29bc4d4

Analysis

max time kernel
91s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2023, 19:29

Target

UIUtils.dll
Size

180KB
MD5

0252531d97f5d6420c1e22ba4dd6fac8
SHA1

46087b06249e48e31e0e41d3d5105dedffb88e63
SHA256

f8cc81353a4edfc4bbf252b1a1651e9572247e9cf2fc178663e3823cc29bc4d4
SHA512

a3b04eaf8a54b36d34650debf1f3b5eb1b733c8c705accd25e200daea8f5eb40ffb03f9a3fce4eb16f9881d48b1be214d623c738d2e942c9697d494927a4743a
SSDEEP

3072:JvqaIIX3IHMXLnuDDvvz5s7gdn3J3X3I9Pz8vH3speqsBZEqFIYPxrkZKEIVjIol:JnX6DnX15jrkQEmfBw5qKjKt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 3912	920	regsvr32.exe	81
PID 920 wrote to memory of 3912	920	regsvr32.exe	81
PID 920 wrote to memory of 3912	920	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\UIUtils.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\UIUtils.dll
  2⤵
  PID:3912