c2603901843b4cccde0c0cb0b830a7383b1ad10ef676042f284b762a5bad6c04

Analysis

max time kernel
138s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 19:08

Target

0144c648c635d1056ff53686778923d6.dll
Size

144KB
MD5

0144c648c635d1056ff53686778923d6
SHA1

0104befe42ef9d14a6172a206efcdc44a5464965
SHA256

c2603901843b4cccde0c0cb0b830a7383b1ad10ef676042f284b762a5bad6c04
SHA512

80d3c84ae06875e3ab23148ad6977e2cc7ff113d106f6d6df733c74e664c1bd5f178ee18c8f6ca1e1810e7b05c862253bff2e6e3797990f7891fc6f9a95b150e
SSDEEP

1536:EEW1NLl7g7eyhLQk9jcnIMLTwp3sp40vcGLyyiIifXls2iymON:4Ll7g7exSjo/Y2vcrOifO7EN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 180	1652	regsvr32.exe	89
PID 1652 wrote to memory of 180	1652	regsvr32.exe	89
PID 1652 wrote to memory of 180	1652	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0144c648c635d1056ff53686778923d6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0144c648c635d1056ff53686778923d6.dll
  2⤵
  PID:180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 180 -ip 180
1⤵
PID:3536

memory/180-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download