9a168220f3adac2609438f399a417b54352b89346853b8c32cdd8beef753abda

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 21:35

Target

049039743714a8bfb9e82d03e888e055.dll
Size

245KB
MD5

049039743714a8bfb9e82d03e888e055
SHA1

32f1b311f7fe6fc9e0c6cb56d9b7751ae3e8a2fd
SHA256

9a168220f3adac2609438f399a417b54352b89346853b8c32cdd8beef753abda
SHA512

6f09db558868cbfa76f2a8489bc8259a0507993485a750c6b5a5733ddd09b5fdba5fac261b1ebcd601fb7ba072bc5199bf09e38984eab53386034a7bff49e6bf
SSDEEP

3072:AaomidlGaomidlGaomidlGaomidlGaomidlGaomidlGaomidl:Ax/Sx/Sx/Sx/Sx/Sx/Sx/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 2868	4564	regsvr32.exe	89
PID 4564 wrote to memory of 2868	4564	regsvr32.exe	89
PID 4564 wrote to memory of 2868	4564	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\049039743714a8bfb9e82d03e888e055.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\049039743714a8bfb9e82d03e888e055.dll
  2⤵
  PID:2868