6e8935d986f0f6151abfa628e868216101ffa611716ea3d5e5739be21938635f

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 07:33

Target

5ccfba80e14ab6cf21a134a1d53d0d19.dll
Size

3.5MB
MD5

5ccfba80e14ab6cf21a134a1d53d0d19
SHA1

13f2895004dfa8724e37239e3de18e3826f189df
SHA256

6e8935d986f0f6151abfa628e868216101ffa611716ea3d5e5739be21938635f
SHA512

a05d51f5ebf1e7c923ee16ae1a662509ec7ef3d0387af3af9a55dfd19a0e3637069491aee374f1b7f1a177ff8e7a0745f172c8cd446e52c7e20ff1e4366a007a
SSDEEP

49152:BcD03QmKka3ANmnlPesf0rIFA+qge6GIz1QlroeafKBZDAW1SvNTJqRlM:93dKkawNE2sf0rIFAt36G65W1lRm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 4636	964	regsvr32.exe	19
PID 964 wrote to memory of 4636	964	regsvr32.exe	19
PID 964 wrote to memory of 4636	964	regsvr32.exe	19

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5ccfba80e14ab6cf21a134a1d53d0d19.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5ccfba80e14ab6cf21a134a1d53d0d19.dll
  2⤵
  PID:4636