5a9124182bc46f8683cffb91a2e21c0cb504ce450afa5dba29b7e2682e6b56c5

Analysis

max time kernel
134s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 19:52

Target

024d64849e8c1ce328f06b7fc3a523fe.dll
Size

224KB
MD5

024d64849e8c1ce328f06b7fc3a523fe
SHA1

9179458ec63b7d6dc29ad69e0f3386d97a7cf1bc
SHA256

5a9124182bc46f8683cffb91a2e21c0cb504ce450afa5dba29b7e2682e6b56c5
SHA512

8b3802ac1fa34602edc1294a864b1930a8d43556983f6e11c83e0c31110f429b7ddac968f79c3beddf1fddb76492b82f27ecf2f5ef6cdd5e28fabbd01e59b065
SSDEEP

3072:s4HVCU4HVCU4HVCU4HVCU4HVCU4HVCU4HVC:HHVCPHVCPHVCPHVCPHVCPHVCPHVC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4200	4900	regsvr32.exe	40
PID 4900 wrote to memory of 4200	4900	regsvr32.exe	40
PID 4900 wrote to memory of 4200	4900	regsvr32.exe	40

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\024d64849e8c1ce328f06b7fc3a523fe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\024d64849e8c1ce328f06b7fc3a523fe.dll
  2⤵
  PID:4200