08336efdfc10ed70f51e72d536bd0be9d8e057e372e2b07581717b8f4ca3c855

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2023 14:11

Target

NEAS.6c6346b942454c4390996b5ce8ab2060.dll
Size

588KB
MD5

6c6346b942454c4390996b5ce8ab2060
SHA1

62b1760df0caede5f8c8d8bd6ef6567bc0e98472
SHA256

08336efdfc10ed70f51e72d536bd0be9d8e057e372e2b07581717b8f4ca3c855
SHA512

f097b3d9a6b0577105796c609c9f80c2dd5c618d3be5156a9e4c91b01f696e7abff449c6fe6091fd4038420a114e3eefbbb95bd84a30ddf39161decf504cbd2e
SSDEEP

12288:OUeVyznpRe6Q2YTQSRrPg7J54C/JKBjvrEH7QE:OzArre6Q2Yd7G/krEH7QE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 4572	408	regsvr32.exe	87
PID 408 wrote to memory of 4572	408	regsvr32.exe	87
PID 408 wrote to memory of 4572	408	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NEAS.6c6346b942454c4390996b5ce8ab2060.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NEAS.6c6346b942454c4390996b5ce8ab2060.dll
  2⤵
  PID:4572