af0c7cbf4b6eb91c8921b263532403d35f7f1917d4f9df8c0915530e7dbd0713

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 18:05

Target

0000bc474771dab2c89fdb6b81515d2e.dll
Size

21KB
MD5

0000bc474771dab2c89fdb6b81515d2e
SHA1

f7471a35f873166bb9653b2a3a6964f69f586ce5
SHA256

af0c7cbf4b6eb91c8921b263532403d35f7f1917d4f9df8c0915530e7dbd0713
SHA512

53f3071eb3923bc09827938cf43f2ed5fb5700f8729e81a9d5c544bbbd1d05d0df57d2e6f7e710f6e907ca88a74d76ed55b1720f1a869405803a6fcf590d48a9
SSDEEP

384:Kn0WWTEcWfif1oOeeN9A2sWjIGwjzEj4BX0td+kP6oF4s9l3dsUnpibfAys3c6:KfRifzNu2sWjDkEjttPPLFbtsj6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 5096	4948	regsvr32.exe	88
PID 4948 wrote to memory of 5096	4948	regsvr32.exe	88
PID 4948 wrote to memory of 5096	4948	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0000bc474771dab2c89fdb6b81515d2e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0000bc474771dab2c89fdb6b81515d2e.dll
  2⤵
  PID:5096

memory/5096-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download