e51134b29bd21386332be947e7754851560dd7d9b5e78457c22d4fa558d0ffed

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 02:37

Target

005d979046b1feaca2a88491c8c648e2.dll
Size

452KB
MD5

005d979046b1feaca2a88491c8c648e2
SHA1

7671bb9e81911675b51cfa042e989b1bf736958a
SHA256

e51134b29bd21386332be947e7754851560dd7d9b5e78457c22d4fa558d0ffed
SHA512

5b336acbd5ca33e7246ad83fa3882b8fb18ecad941a78052b17184b66751cf4aff8bbac68206658c0fccef599a19a4026e20d41c1138efea80d58ee1377ead97
SSDEEP

12288:RpsGQ0bftxgEoAsxMpM3QSxFwj8KHYq2IRGkwwDfZ9MBs+ce:Rxbft/olxomXEGkwIfZ9My+B

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 336	2900	regsvr32.exe	88
PID 2900 wrote to memory of 336	2900	regsvr32.exe	88
PID 2900 wrote to memory of 336	2900	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\005d979046b1feaca2a88491c8c648e2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\005d979046b1feaca2a88491c8c648e2.dll
  2⤵
  PID:336

memory/336-1-0x0000000002640000-0x0000000002781000-memory.dmp

Filesize
1.3MB

Download
memory/336-0-0x0000000002640000-0x00000000027BF000-memory.dmp

Filesize
1.5MB

Download
memory/336-2-0x0000000002640000-0x00000000027BF000-memory.dmp

Filesize
1.5MB

Download