005e1c6455cbf41021b9325e1b7a7302f85fc9548500193b9818f1a9b4ce3fab

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 16:35

Target

0609ceadde9338b5d3383eaebfe5956a.dll
Size

573KB
MD5

0609ceadde9338b5d3383eaebfe5956a
SHA1

b7e35a034b221bd27e37717fd1208edfb80b8248
SHA256

005e1c6455cbf41021b9325e1b7a7302f85fc9548500193b9818f1a9b4ce3fab
SHA512

b0a8a9d79656d2697c7ad341ec9370069ff8bc4b4bedd0f6a6ee80935aa65f5f288a61e2b68ac6049fc99531d7dbebbdf0843b228c4d671458f4cbb59a9fb4bb
SSDEEP

12288:UgIqyzslqspgMzTgVvalnAA7/BeYdyQ7pAY19VYV8ify:5IqrAVvaJ5peEZFcVXfy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 1816	4412	regsvr32.exe	88
PID 4412 wrote to memory of 1816	4412	regsvr32.exe	88
PID 4412 wrote to memory of 1816	4412	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0609ceadde9338b5d3383eaebfe5956a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0609ceadde9338b5d3383eaebfe5956a.dll
  2⤵
  PID:1816

memory/1816-0-0x0000000000770000-0x000000000077E000-memory.dmp

Filesize
56KB

Download