e4a443b34668df105c8493df9b54e068a1eccde179a0cea964bd858ff0165c14

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 19:34

Target

385f3a0abaa8e640f837c8c82070ae08.dll
Size

262KB
MD5

385f3a0abaa8e640f837c8c82070ae08
SHA1

ef787ce831bdc2eaef7e42231d9107e24ff16d79
SHA256

e4a443b34668df105c8493df9b54e068a1eccde179a0cea964bd858ff0165c14
SHA512

7be8ce1e48a5f78d17df43b47317293855c751d69c08a1d21491c6afae654469bc60b4162c8b765d07b5b80ad9510db71825a33496adc3ece19904a91ba60739
SSDEEP

3072:Ro59mNmobMhoq0X+u+S1w/lgqnHKc+foKQ5RQZEYFBkHj3HWyMSjwvfIuAIbDlMe:0QmUbqHKupnQyYFGD3TDjwvglO9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 4460	2304	regsvr32.exe	14
PID 2304 wrote to memory of 4460	2304	regsvr32.exe	14
PID 2304 wrote to memory of 4460	2304	regsvr32.exe	14

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\385f3a0abaa8e640f837c8c82070ae08.dll
1⤵
PID:4460

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\385f3a0abaa8e640f837c8c82070ae08.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2304