bdc5dd259e5404b11be051a4d5acecd15d8cc8dc4a68adfb8bc3aec523023fb0

Analysis

max time kernel
143s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 00:44

Target

1de070532dcc9e6171bb3bd9220794b8.dll
Size

116KB
MD5

1de070532dcc9e6171bb3bd9220794b8
SHA1

4d627397c645b8de082293efdec4c2dcb14a93a5
SHA256

bdc5dd259e5404b11be051a4d5acecd15d8cc8dc4a68adfb8bc3aec523023fb0
SHA512

e8463ed8def97a5d86ac34e2b50568ea25295f0f1922d01a27777a123ed5e47346aa122fea352f5447fef27ef84655ebcf2b62fdef265b331fada735b0ec1e81
SSDEEP

768:mPJXFQoiRqZOxQqSyoJoChjLs4l4I5jmQP/gCRWHJd0WFQpOKDzfpMalPpB59xHO:mBVQvRqZEQ1TNRrmpGOKvBzhB595ohH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 4456	2952	regsvr32.exe	15
PID 2952 wrote to memory of 4456	2952	regsvr32.exe	15
PID 2952 wrote to memory of 4456	2952	regsvr32.exe	15

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1de070532dcc9e6171bb3bd9220794b8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1de070532dcc9e6171bb3bd9220794b8.dll
  2⤵
  PID:4456

memory/4456-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download