a219f83f56d49adb1dcda0120c124384cf7f25b71b48e607503e5a6a62a9ceb5

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 22:51

Target

fe06641b8a955a3601c3abd4587180b3.dll
Size

128KB
MD5

fe06641b8a955a3601c3abd4587180b3
SHA1

81570f492ba5b77a68f599d27c8b68668595714c
SHA256

a219f83f56d49adb1dcda0120c124384cf7f25b71b48e607503e5a6a62a9ceb5
SHA512

0ba6b898437a44a487dc3bde8f734c82de6258d2e09461f483fbcedeb021693683eaa63a051aa1d2474efd6d75be1c35bb4ec616f4472a8b28190a95bf2d622f
SSDEEP

768:H2fCZqoQO8obQ0xJTK229keAdhrIohbtyN17a7XOueWHCf3qKUihcoJHO9Udmn1:HrZqoQybQ6Thhr1bc17azHA6BKr89U+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 4860	552	regsvr32.exe	15
PID 552 wrote to memory of 4860	552	regsvr32.exe	15
PID 552 wrote to memory of 4860	552	regsvr32.exe	15

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fe06641b8a955a3601c3abd4587180b3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fe06641b8a955a3601c3abd4587180b3.dll
  2⤵
  PID:4860

memory/4860-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download