52fd9aacccc71722d1d41b74d526dd10b32364fd24477dbac2c2e5cb91a31f81

Analysis

max time kernel
145s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 22:45

Target

fdaf317ed1aea28a66c0f3fcbcd0e4c7.dll
Size

115KB
MD5

fdaf317ed1aea28a66c0f3fcbcd0e4c7
SHA1

cce786637c96c6af481a76c5992e3f6a2e03f719
SHA256

52fd9aacccc71722d1d41b74d526dd10b32364fd24477dbac2c2e5cb91a31f81
SHA512

e88b1871b716dd0cabcbfd8535fa9826d770e9f2a88f4893f2d3996dc6cc4256e4e39a798ab77925ba1ad03e92310384d89aecb9b918c1e71c7541bab0f0cfad
SSDEEP

1536:9HV9JfRHsBVTchd61hBI8tBhE2J0npku1vgaZsZUMouLFNykk0:VV9JfRHs3cb6ySw2JgtFsZU3uTykX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 1088	2132	regsvr32.exe	89
PID 2132 wrote to memory of 1088	2132	regsvr32.exe	89
PID 2132 wrote to memory of 1088	2132	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fdaf317ed1aea28a66c0f3fcbcd0e4c7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fdaf317ed1aea28a66c0f3fcbcd0e4c7.dll
  2⤵
  PID:1088