94bb019ddb05ed2c3d703aa819b403c7322eca253dd7cc5b258c6e1f01bef47a

Analysis

max time kernel
149s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 10:06

Target

155aa4589179ec1984761e50acbd7b39.dll
Size

51KB
MD5

155aa4589179ec1984761e50acbd7b39
SHA1

63b0006e7f124cd31cf5e00ee855481cccaa32d6
SHA256

94bb019ddb05ed2c3d703aa819b403c7322eca253dd7cc5b258c6e1f01bef47a
SHA512

d2c5980991084e233ef0b0b74681550ad57701abfdca578a0a45c229bf5fec9a85b35b8082dffde2624feaa74c4be2dc190c879a9a8ae99f93698fd0d1845cf2
SSDEEP

768:S9gUno8dMD6k5MmGQ/Q7LPrXPhbanF0DdFIglb7i7qFAuHbWkEPArg8mZrGSG:SKSQ6kNY7LPjMnawC7DrEPArg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 4432	3744	regsvr32.exe	90
PID 3744 wrote to memory of 4432	3744	regsvr32.exe	90
PID 3744 wrote to memory of 4432	3744	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\155aa4589179ec1984761e50acbd7b39.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\155aa4589179ec1984761e50acbd7b39.dll
  2⤵
  PID:4432

memory/4432-0-0x00000000610C0000-0x00000000610D6000-memory.dmp

Filesize
88KB

Download