9c7bf27bc7bc9916c244d6f092a4992bd21b3d1e95c9591b837d1c1fcc01462d

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 13:16

Target

9dda1e5eedef09c47bc892ca065dcc6f.dll
Size

5.6MB
MD5

9dda1e5eedef09c47bc892ca065dcc6f
SHA1

1edfa38f1d013ca22b3aa183e8a1760593734eff
SHA256

9c7bf27bc7bc9916c244d6f092a4992bd21b3d1e95c9591b837d1c1fcc01462d
SHA512

37232334dcf1d4734b408a8328eeaffe9d457c76b31cf7af787cbadf1b15cfb786a763b2c407a1fcd21cda1ccf95ef0316384cf855980e634e6b109d5718bff1
SSDEEP

98304:bFGhb0zSPiP6Pw1rXBuvBiRYn4jBMzzjYwF8ktRayVfcfD1meCx:bI4jR5XqL8ktRaEfePe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 216	752	regsvr32.exe	20
PID 752 wrote to memory of 216	752	regsvr32.exe	20
PID 752 wrote to memory of 216	752	regsvr32.exe	20

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9dda1e5eedef09c47bc892ca065dcc6f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9dda1e5eedef09c47bc892ca065dcc6f.dll
  2⤵
  PID:216

memory/216-0-0x0000000010000000-0x0000000010509000-memory.dmp

Filesize
5.0MB

Download
memory/216-1-0x0000000002390000-0x0000000002BAB000-memory.dmp

Filesize
8.1MB

Download
memory/216-4-0x0000000000A00000-0x0000000000A02000-memory.dmp

Filesize
8KB

Download
memory/216-3-0x00000000034B0000-0x00000000034C7000-memory.dmp

Filesize
92KB

Download
memory/216-2-0x0000000002BB0000-0x00000000034AA000-memory.dmp

Filesize
9.0MB

Download
memory/216-6-0x0000000002BB0000-0x00000000034AA000-memory.dmp

Filesize
9.0MB

Download
memory/216-5-0x00000000034B0000-0x00000000034C7000-memory.dmp

Filesize
92KB

Download