3deeb43de6bf9d55ca88957d975a9f923372f5d372a9ccfd2ba4c470f9c61a79

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2023 23:35

Target

3deeb43de6bf9d55ca88957d975a9f923372f5d372a9ccfd2ba4c470f9c61a79.dll
Size

176KB
MD5

cf50e9e1e9b77d2377784dcc75fc873c
SHA1

cacea67e43bad6464ac626d4a87f4523980a2c28
SHA256

3deeb43de6bf9d55ca88957d975a9f923372f5d372a9ccfd2ba4c470f9c61a79
SHA512

45d8e99da0ebbdf817620ee4f2c6d301c2429019fc2596b83711c27afde9b0ba55658cd621458b6efc0d0757406d86562b0c037627bd83e01516f39b8899c716
SSDEEP

1536:mCXROAD6hsH+kKY0hyrF+av4O7skhygV8nIIt8odcYHTqA1kCVjT:ZTQXajVGhp1nT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 4160	3688	regsvr32.exe	85
PID 3688 wrote to memory of 4160	3688	regsvr32.exe	85
PID 3688 wrote to memory of 4160	3688	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3deeb43de6bf9d55ca88957d975a9f923372f5d372a9ccfd2ba4c470f9c61a79.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3deeb43de6bf9d55ca88957d975a9f923372f5d372a9ccfd2ba4c470f9c61a79.dll
  2⤵
  PID:4160