624ba57aa44234177d9f7c5bbaaa9ae266b3fcc9fd68ca069daa165e02c29d6d

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 19:57

Target

0f465b7b2482625258ee953bcdb31422.dll
Size

590KB
MD5

0f465b7b2482625258ee953bcdb31422
SHA1

cb649f87fd89c8ea0523b4738c2eb7889b047687
SHA256

624ba57aa44234177d9f7c5bbaaa9ae266b3fcc9fd68ca069daa165e02c29d6d
SHA512

2df83343d9fe2f9ca2ce4dda943dbaf0cd622652b85d2735594922243947d769fcf1aa8dca6a93b1c2f014220cf44807576c2cdfa5aa7ca8bf516c114f853267
SSDEEP

12288:6DYjDYjDYjDYjDYjDYjDYjDYjDYjDYjDYjDYjDYjDYjDYjDYjDYjDYjDYY:pIIIIIIIIIIIIIIIIIIY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 1260	3908	regsvr32.exe	17
PID 3908 wrote to memory of 1260	3908	regsvr32.exe	17
PID 3908 wrote to memory of 1260	3908	regsvr32.exe	17

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0f465b7b2482625258ee953bcdb31422.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0f465b7b2482625258ee953bcdb31422.dll
  2⤵
  PID:1260