d589ebaf74527c99101430b7fd5ba84ce9796d731e68c2c9b89e593c78bd1fcf

Analysis

max time kernel
147s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 02:40

Target

0bfb5ca736060e0764c3f2c9a4200bcc.dll
Size

124KB
MD5

0bfb5ca736060e0764c3f2c9a4200bcc
SHA1

9212d24e7974aafb714b2e7d6d228148878d9f85
SHA256

d589ebaf74527c99101430b7fd5ba84ce9796d731e68c2c9b89e593c78bd1fcf
SHA512

0884ca620382881cdc58d12f22b22ca97edbfad40f9c8abb3762d080fd088b84d8a430acc33e8368b6309181ef4d177f13b3fee0742daabac8126cc60ef317ea
SSDEEP

1536:kbNnw8+UQ0XamSihz+h5ISICS4AG9qDJh4aX01E5U7ZJLLaHzwtz:gRwhJKSiB+hixE9CJh4/1EGYHz8z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 4084	2788	regsvr32.exe	89
PID 2788 wrote to memory of 4084	2788	regsvr32.exe	89
PID 2788 wrote to memory of 4084	2788	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0bfb5ca736060e0764c3f2c9a4200bcc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0bfb5ca736060e0764c3f2c9a4200bcc.dll
  2⤵
  PID:4084