0dccd321bfb6b4664886ecb657f4288647cbdb3a38c29971d4d10a4c0462b0fd

Analysis

max time kernel
142s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 07:40

Target

126646be94856227c0f499a8db011337.dll
Size

213KB
MD5

126646be94856227c0f499a8db011337
SHA1

116307fe8b814123c9cb184301f876e1fc1d03ac
SHA256

0dccd321bfb6b4664886ecb657f4288647cbdb3a38c29971d4d10a4c0462b0fd
SHA512

7b065c0ae11d13fd11f0318ea6abab77218bb81779c1744bd4469f534efd698f7c9531f1d66461c01cb660d8ecf5e3be2ea36731dd133f0a1436cb6251a3a4eb
SSDEEP

3072:IXJfcA/h/XJfcA/h/XJfcA/h/XJfcA/h/XJfcA/h/XJfcA/h/XJfcA/h:tOQOQOQOQOQOQO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 1504	4748	regsvr32.exe	12
PID 4748 wrote to memory of 1504	4748	regsvr32.exe	12
PID 4748 wrote to memory of 1504	4748	regsvr32.exe	12

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\126646be94856227c0f499a8db011337.dll
1⤵
PID:1504

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\126646be94856227c0f499a8db011337.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4748