cf156e4aff9719ccdffa2535316da0017a4172bd53218f43b650d24b3919f952

Analysis

max time kernel
165s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 18:06

Target

00096185d742ea754e078d7b66f4c3cc.dll
Size

19KB
MD5

00096185d742ea754e078d7b66f4c3cc
SHA1

10202b8324400411d25febb7d5d53c701527ca90
SHA256

cf156e4aff9719ccdffa2535316da0017a4172bd53218f43b650d24b3919f952
SHA512

21833aa0554891c07d51f62f6dba4d0c9e476b27214fa011f2b5e3dc059c558520e2a459b3519445242582dba71b8abf0b09f6efecad6114fdaaec9bebc30b75
SSDEEP

384:LWWTEcWrVeO9PrCZFnFf+KagG2aXq1M37Lit1co6NqxiJxxHieP7zR1:k9oFnFWKal2P826NqEYeP7P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 4392	4780	regsvr32.exe	88
PID 4780 wrote to memory of 4392	4780	regsvr32.exe	88
PID 4780 wrote to memory of 4392	4780	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\00096185d742ea754e078d7b66f4c3cc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\00096185d742ea754e078d7b66f4c3cc.dll
  2⤵
  PID:4392

memory/4392-0-0x00000000009F0000-0x0000000000A0D000-memory.dmp

Filesize
116KB

Download