7c52f8c6215caf91a76c3406bf282f3f4c2ddb115752b67ac366c9babac1a0bd

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 00:46

Target

08ffc9563045195d66f323c93b2a5148.dll
Size

43KB
MD5

08ffc9563045195d66f323c93b2a5148
SHA1

5f00475514de6fed95167b1bb3300dc48dc0adda
SHA256

7c52f8c6215caf91a76c3406bf282f3f4c2ddb115752b67ac366c9babac1a0bd
SHA512

2bc62777651464a84ec03d284d1a92614478cde0c35ea60d3f26a315c6985857a566138bd4302cb8fc4db69eb5df768564ab01424a6a5c9bb002fd97a1c25f15
SSDEEP

768:tCSqWQ1geCiG7LrpbCTiO5OpBl3JX+SsG8fB4ZEU8BSQcTgpoPx4qSfN:8SqWQGP7LrpuTiGOpBl3ESs9B4ZEUWjb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 1028	4852	regsvr32.exe	14
PID 4852 wrote to memory of 1028	4852	regsvr32.exe	14
PID 4852 wrote to memory of 1028	4852	regsvr32.exe	14

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\08ffc9563045195d66f323c93b2a5148.dll
1⤵
PID:1028

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\08ffc9563045195d66f323c93b2a5148.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4852

memory/1028-0-0x0000000000600000-0x0000000000610000-memory.dmp

Filesize
64KB

Download