ed44b9a6a11b99f72b5349b4cf49329aa8fc5b34790c098cd9b6f879ec7c06d2

Analysis

max time kernel
96s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2023, 10:46

Target

ed44b9a6a11b99f72b5349b4cf49329aa8fc5b34790c098cd9b6f879ec7c06d2.dll
Size

124KB
MD5

8d760be953b787539a673c103cad20f3
SHA1

1eb39aab4efb59bb20d36fc99fd65586264b63de
SHA256

ed44b9a6a11b99f72b5349b4cf49329aa8fc5b34790c098cd9b6f879ec7c06d2
SHA512

6bd554255b166cc3bda0801e26aa7c9e085067290559745d57aa5147a26aebe0087039e6955f3c4959391393f8c9312bce65da60908b8b824ab25ffdb73dff49
SSDEEP

3072:wYpka1hFfNjdjpn72wpsSiaK5Axmam2FT:h5NjdjdpQAxmam2FT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1452	2228	regsvr32.exe	83
PID 2228 wrote to memory of 1452	2228	regsvr32.exe	83
PID 2228 wrote to memory of 1452	2228	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ed44b9a6a11b99f72b5349b4cf49329aa8fc5b34790c098cd9b6f879ec7c06d2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ed44b9a6a11b99f72b5349b4cf49329aa8fc5b34790c098cd9b6f879ec7c06d2.dll
  2⤵
  PID:1452