cffa134fd0bc71e6eab283e08c8d92e68376044f9deed67c96eb3a52c65daf6a

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 21:48

Target

3e41caf0277fe569e2cc6eeb71902028.dll
Size

224KB
MD5

3e41caf0277fe569e2cc6eeb71902028
SHA1

21cf71947cf5707d52abe226e37c950b719a3431
SHA256

cffa134fd0bc71e6eab283e08c8d92e68376044f9deed67c96eb3a52c65daf6a
SHA512

285b993a92e171d2fac3fa421af344e38262c3e871af167bcc097824bf3843953d20c1fbf0873090e495ef83f8616e45aec31a8430ff7898bbbf7403ccca014f
SSDEEP

6144:nA/KrBz6A/KrBz6A/KrBz6A/KrBz6A/KrBz6A/KrBz6A/KrBz:nOpOpOpOpOpOpO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 3524	3216	regsvr32.exe	87
PID 3216 wrote to memory of 3524	3216	regsvr32.exe	87
PID 3216 wrote to memory of 3524	3216	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3e41caf0277fe569e2cc6eeb71902028.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3e41caf0277fe569e2cc6eeb71902028.dll
  2⤵
  PID:3524