4df2cddeaa47a4bbf44c323aa71f1943d7feac36e8a4e3f36af5de593560055c

Analysis

max time kernel
82s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2023 15:53

Target

55f53b1d9dac903d695b48f52894117a87acd81c1c10fc6eafb6dad5d6bc28b4.dll
Size

132KB
MD5

ba33bff302fdecf939ed96296d93593f
SHA1

f422c218c50549a380234e6c57231e95a5774371
SHA256

55f53b1d9dac903d695b48f52894117a87acd81c1c10fc6eafb6dad5d6bc28b4
SHA512

3ca1e38a95818811f15aedd86bd202e4e698600e3a9143c338b4908ca8b5890f9f7a81f75df7f4337b1331de4e49428dd17d996bd21691e600385f67afcaabbf
SSDEEP

3072:W3sOOO1kCH3gxtJC8UDqYfGbKDkvKjxCy:W3sOl1kqOC8U/6Ikyjx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4908 wrote to memory of 3944	4908	regsvr32.exe	regsvr32.exe
PID 4908 wrote to memory of 3944	4908	regsvr32.exe	regsvr32.exe
PID 4908 wrote to memory of 3944	4908	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\55f53b1d9dac903d695b48f52894117a87acd81c1c10fc6eafb6dad5d6bc28b4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4908

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\55f53b1d9dac903d695b48f52894117a87acd81c1c10fc6eafb6dad5d6bc28b4.dll
2⤵
PID:3944