796dde665a3b1c9ebc1a0a73a7bfdf6ac66010684a782a8845e0093cc72e461a

Analysis

max time kernel
87s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 12:07

Target

180415204118b5aa2f540810112771aa.dll
Size

160KB
MD5

180415204118b5aa2f540810112771aa
SHA1

a923405796151a7f578435a73ef9c34c50269400
SHA256

796dde665a3b1c9ebc1a0a73a7bfdf6ac66010684a782a8845e0093cc72e461a
SHA512

7391b84d2052354b7d5cbb0dfc90e5cdea66cdf7314e795574abe67d6633a4a91202e7d852b94cc10b3b2751f72fc1782d9478e0bf930dfa5714436ca83f46b9
SSDEEP

1536:7Rfbm3Kf4MyRVehVqETpgA866Cdip6C9DJ9yFzYJ0P5TW+Vif3cIMSJPw:7RfbMK67eh3TpgAcCSLJszYJ0hVifA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 4624	2940	regsvr32.exe	87
PID 2940 wrote to memory of 4624	2940	regsvr32.exe	87
PID 2940 wrote to memory of 4624	2940	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\180415204118b5aa2f540810112771aa.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\180415204118b5aa2f540810112771aa.dll
  2⤵
  PID:4624