75feb670fd47446937a33860790e12073c6bb588a3fdefd1f313bda0aee4b1f9

Analysis

max time kernel
173s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 07:44

Target

0fcd2d2702602096f858d4a60dc8d2fe.dll
Size

120KB
MD5

0fcd2d2702602096f858d4a60dc8d2fe
SHA1

3d249b1ad6d3160f711dd4e44c04472bf991c152
SHA256

75feb670fd47446937a33860790e12073c6bb588a3fdefd1f313bda0aee4b1f9
SHA512

e085372efb8c37e94966801e8663968555bd53777e63f3f3b2221962b3d66c6f7ce3a1e4c9788f7511aadfac6d45f2610513799dcf6b9ad65f0c1a7c248605fa
SSDEEP

1536:YVq0QBiiT9uCS2TWCZ1R7Nu+RmV+0jcfNIFDIMChn:u2iisCSd7+RmV+0jcfNmCx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2216	1516	regsvr32.exe	90
PID 1516 wrote to memory of 2216	1516	regsvr32.exe	90
PID 1516 wrote to memory of 2216	1516	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0fcd2d2702602096f858d4a60dc8d2fe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0fcd2d2702602096f858d4a60dc8d2fe.dll
  2⤵
  PID:2216

memory/2216-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download