008ee5ba56b17b878f061bf22f16a4b84e95984ca4006b8344e422ec11bbb7fe

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 02:44

Target

0c127f7e3cc6b9b4b0577fd43176394d.dll
Size

117KB
MD5

0c127f7e3cc6b9b4b0577fd43176394d
SHA1

bd8b349d17934e43c8523c8aa33401b88b08fc91
SHA256

008ee5ba56b17b878f061bf22f16a4b84e95984ca4006b8344e422ec11bbb7fe
SHA512

d76b1b9c2f8cdf38b01febabf905ac5023d720adbc5669f6e4fd7d89802d730f2992791922677e456d7497576875d0769b9aaf74275bc69f1a2c66086a7e638a
SSDEEP

3072:PQx+UbCsinSomEN803/IuSNHUiyohXnPR1SCG0MKiy0916RbeR:5iqyEN80sHUVoJnSr5yes0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 1360	3744	regsvr32.exe	88
PID 3744 wrote to memory of 1360	3744	regsvr32.exe	88
PID 3744 wrote to memory of 1360	3744	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0c127f7e3cc6b9b4b0577fd43176394d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0c127f7e3cc6b9b4b0577fd43176394d.dll
  2⤵
  PID:1360

memory/1360-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1360-1-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download