27bc4a1048323ba4c41c319086eb019255543cc28abf93dc14a74fabc9277819

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2023, 13:39

Target

27bc4a1048323ba4c41c319086eb019255543cc28abf93dc14a74fabc9277819.dll
Size

1.5MB
MD5

db5fb4ee7e7b7b7573a7474a360c1d35
SHA1

268d88c0eaa4fb6faa7521d3c42ba890f2def449
SHA256

27bc4a1048323ba4c41c319086eb019255543cc28abf93dc14a74fabc9277819
SHA512

f46887d0ee3bf6bd9cbd64f227db625c2d1ea9d4344b590a4769a106bde983b21da9a389127b5cb410dd4f9941f4b53ef8e4eeb754081a5055f8f0b2346c9034
SSDEEP

24576:3T1Qp8HnGWyuW3vorPzHlTcNofNp179U4J8ib9pjFb:3Cp8HGWyuW3ArpIGFpRe4qi5pBb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 2740	748	regsvr32.exe	86
PID 748 wrote to memory of 2740	748	regsvr32.exe	86
PID 748 wrote to memory of 2740	748	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\27bc4a1048323ba4c41c319086eb019255543cc28abf93dc14a74fabc9277819.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\27bc4a1048323ba4c41c319086eb019255543cc28abf93dc14a74fabc9277819.dll
  2⤵
  PID:2740