f55141cf529f272656e20ae0f627edb5c684225c39cdabd45c0063223c0b6ca4

Analysis

max time kernel
150s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 18:07

Target

000eeb25be64dbf21138ab284453e2cc.dll
Size

20KB
MD5

000eeb25be64dbf21138ab284453e2cc
SHA1

72250dc69950a38f8770a18939c7fc8b1df3f3a7
SHA256

f55141cf529f272656e20ae0f627edb5c684225c39cdabd45c0063223c0b6ca4
SHA512

9e02c27c51ca30b2db3401089e6ef25d731ae707922a5c61f73628658076b7afa27c3b4a8af5286db2e67193ff165aca667b64883c9f074b684ed3e7f200a00f
SSDEEP

384:LWWTEcWk+/aILLj8KmIBWCrVxVsarv1hmjuSsMJpn7E40nqnYc:k6gL4S4CpxVrRMJh7E4Uqnr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 3268	1808	regsvr32.exe	88
PID 1808 wrote to memory of 3268	1808	regsvr32.exe	88
PID 1808 wrote to memory of 3268	1808	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\000eeb25be64dbf21138ab284453e2cc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\000eeb25be64dbf21138ab284453e2cc.dll
  2⤵
  PID:3268

memory/3268-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download