bdd76bb3b8e382db3a3d7a8da5ad3ba8be7e13ee66466280eb6c64a4924aeddf

Analysis

max time kernel
134s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 23:27

Target

43306a6e59ad7e64fd64faf5c1681998.dll
Size

217KB
MD5

43306a6e59ad7e64fd64faf5c1681998
SHA1

97b645fce2a26a07ce51d0d565e654c3e3cd537b
SHA256

bdd76bb3b8e382db3a3d7a8da5ad3ba8be7e13ee66466280eb6c64a4924aeddf
SHA512

7394ea85f600127075cd0ab1193307d3114f00d6e9e60ad53540128e35dc853dc0fe4f5f4c993c9fb638601da67996a8dbf32980171fcd94a7e59a1aa24cbfcb
SSDEEP

6144:CrutjWerutjWerutjWerutjWerutjWerutjWerutjW:Crperperperperperperp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 2972	4136	regsvr32.exe	13
PID 4136 wrote to memory of 2972	4136	regsvr32.exe	13
PID 4136 wrote to memory of 2972	4136	regsvr32.exe	13

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\43306a6e59ad7e64fd64faf5c1681998.dll
1⤵
PID:2972

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\43306a6e59ad7e64fd64faf5c1681998.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4136