18001a5de9b1be31fa0e8c10b9a37483b42575430158576f84a43c6e4f936c32

Analysis

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 21:35

Target

0493bdc9e46741fdc361f2953a8a4f07.dll
Size

45KB
MD5

0493bdc9e46741fdc361f2953a8a4f07
SHA1

e5dfb70559a31c3b329b175206277c2f8112b3d5
SHA256

18001a5de9b1be31fa0e8c10b9a37483b42575430158576f84a43c6e4f936c32
SHA512

e9fa7611cd1c3cb62f0114b66d724f01ff66669250cdcc46a5f7f4621768e65d5ee5422390c97c7b8ef748596550476fc5e6f953b2d74f3e4d782f9974d9000d
SSDEEP

768:aDCSqWQ1geCiGgLTqiY8eOa/iO5OpBlmfrJQzAXZ3QGEVrSToSxVHxiS:amSqWQGPgLTqiTa/iGOpBlmcAJ3QGQrS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 1132	1836	regsvr32.exe	31
PID 1836 wrote to memory of 1132	1836	regsvr32.exe	31
PID 1836 wrote to memory of 1132	1836	regsvr32.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0493bdc9e46741fdc361f2953a8a4f07.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0493bdc9e46741fdc361f2953a8a4f07.dll
  2⤵
  PID:1132