34d3a0ce3112caf98e90fb9b2964f57c221b0f42309fde4a61d9d342fbed150b

Analysis

max time kernel
141s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 22:27

Target

400df841a2944a12df98cdbcbf49535b.dll
Size

588KB
MD5

400df841a2944a12df98cdbcbf49535b
SHA1

b97c73ba28403665bbfa19ef3f38a3a61cfc83b3
SHA256

34d3a0ce3112caf98e90fb9b2964f57c221b0f42309fde4a61d9d342fbed150b
SHA512

32f67ed2a0e779642ac7d6fa13949da6685fbf3862cac2c6ad85741c26997ca71ef60ade31dfe53a0921a5d485236dee22cbb409b7ec53a0e8f74003ae373194
SSDEEP

1536:sYUge0rTC2tOmXbJVaK3R0XMJ33iU5hVXl7NeLZ61due6moMNNlltdgHXTzHrz0k:NZTOubqoNNfor

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 3632	3980	regsvr32.exe	15
PID 3980 wrote to memory of 3632	3980	regsvr32.exe	15
PID 3980 wrote to memory of 3632	3980	regsvr32.exe	15

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\400df841a2944a12df98cdbcbf49535b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\400df841a2944a12df98cdbcbf49535b.dll
  2⤵
  PID:3632