30a7cfe571c6738c080f5d8497feb230c8462be7919bac26c300fa815c17e88e

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 08:25

Target
1359fe2701275b9cbe69a056cc23cc4c.dll
Size 837KB
Sample231230-kbgqvscec8
SHA256 30a7cfe571c6738c080f5d8497feb230c8462be7919bac26c300fa815c17e88e
MD5 1359fe2701275b9cbe69a056cc23cc4c
SHA1 aae65377458b533f53d1aa38e9614352b00a5a4f
SHA512 b4b75493a7601a8438104adb7557f9f688d5a42e41e31bf7a06f2c8d3f48754044d6287dd114bfc0af17b809c4189a449d0162bb6232dd3eb1be7b60e07cf6c8
SSDEEP 12288:36w8vxDbovwwiy2Z610hOtlx3nactdsyzU0XyVoo6hGzOIEv:qw8JDbVyAAPUgy4GzO3v
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3812	4816	regsvr32.exe	88
PID 4816 wrote to memory of 3812	4816	regsvr32.exe	88
PID 4816 wrote to memory of 3812	4816	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1359fe2701275b9cbe69a056cc23cc4c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1359fe2701275b9cbe69a056cc23cc4c.dll
  2⤵
  PID:3812