8b3c6a051d3d95055e9571c53346a0e262b32d17bbc26de495cffddd7b73528f

Analysis

max time kernel
144s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:50

Target

ArmAccess.dll
Size

52KB
MD5

c841204b08d5a330f4e0503430f82e24
SHA1

5720d7eba4fdae55a7e67cfe3637cfda02d2e953
SHA256

089869db6efb52ce41dc6f0ab859164c7a316f4ae082cdc45b1ea7921fd42505
SHA512

22542300bc25ea84906c2ec7fd0588a9be67f9c44732f1c9c3ac8f2049a1941f2c746888c5635beb6a00049743cbb322143d698af7d501e9f5fc17738900e9ea
SSDEEP

384:TWNNgJdY59tTulkbETxYpx6y2LfiqoYBUcz837yIYh9JzxovS1f2uUIiho38oqee:SIwTulXtkmfZBe7EtFovs2I38ozSihb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 2888	3484	regsvr32.exe	15
PID 3484 wrote to memory of 2888	3484	regsvr32.exe	15
PID 3484 wrote to memory of 2888	3484	regsvr32.exe	15

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ArmAccess.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ArmAccess.dll
  2⤵
  PID:2888