30a2ff8e469ba8fda106a76e49fe9a0b3f7c4a35ad50c2e8e961ee0a0d754f4f

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 18:48

Target

00e735730c09dec1b54c772b49d98677.dll
Size

2.2MB
MD5

00e735730c09dec1b54c772b49d98677
SHA1

ce6507472805cac924ec57c8741c6edb34087519
SHA256

30a2ff8e469ba8fda106a76e49fe9a0b3f7c4a35ad50c2e8e961ee0a0d754f4f
SHA512

5d118f5411f9d9b1901c29128f723bd9eb62d96a763fc090bcd86d9670e12d9c65197affed14f43e7a8f64cf068ce9ca24fa93ab999c5307ec3d365fdb22976d
SSDEEP

49152:YXAu7VrwpLS88Hkj+JibPU2ttX6l94tcRTZpYplFxh/:YQarKLS8zSJQtx6l94tcGx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 3008	3400	regsvr32.exe	88
PID 3400 wrote to memory of 3008	3400	regsvr32.exe	88
PID 3400 wrote to memory of 3008	3400	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\00e735730c09dec1b54c772b49d98677.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\00e735730c09dec1b54c772b49d98677.dll
  2⤵
  PID:3008