77f5c93c8e566d5b9c334500fc79b0cf3ae898b263018672dc5dcf8c5032ac3e

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 09:38

Target

64553f0624e8bf15ce433c302905392a.dll
Size

128KB
MD5

64553f0624e8bf15ce433c302905392a
SHA1

a9fd6392eb9350953d09e0fb00ac62606ee20acc
SHA256

77f5c93c8e566d5b9c334500fc79b0cf3ae898b263018672dc5dcf8c5032ac3e
SHA512

5504d9eff9e000c4ed27e4d9bf97d20ea9f3c7b4bc889bc991c3a73b62a620b202eb667510c02d636d461a459fc073be90b3546977b1eb7860d2853e0c5d8cfb
SSDEEP

1536:ryqHQrqzXcoN+2TI+vdaCjYqBZkwuKoR7j3Ju/dkrwKW:l+G1NpNvdSq3kUy7j5WdkrwKW

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 680 wrote to memory of 1704	680	regsvr32.exe	17
PID 680 wrote to memory of 1704	680	regsvr32.exe	17
PID 680 wrote to memory of 1704	680	regsvr32.exe	17

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\64553f0624e8bf15ce433c302905392a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:680
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\64553f0624e8bf15ce433c302905392a.dll
  2⤵
  PID:1704

memory/1704-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download