0ca93f97434a7311f4eda6476d6b76aed753c5e5b34eefd4507fff1cac6fb063

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 14:28

Target

1b6d0e044569310fdbcbfe6d3780f605.dll
Size

124KB
MD5

1b6d0e044569310fdbcbfe6d3780f605
SHA1

a3b8c4a65a075eae1d12a8e7d6619836d77d02d1
SHA256

0ca93f97434a7311f4eda6476d6b76aed753c5e5b34eefd4507fff1cac6fb063
SHA512

c8bc0958adea232c6d84d05e587c019cef9b416c5c26a080c2f9e56b2cc8f50ae466fdef355c1ef74b537e2aa1d2354633214cef7f1d02a34592739834bbed9e
SSDEEP

3072:AMpULtUTGlgXAozGCJSIrdQNyvx4yojiBd3DTHPOx0rSSS+LGpY7zwyO:DGJUGoQQCg6kBxfHPOm9HGs

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3920	4508	regsvr32.exe	87
PID 4508 wrote to memory of 3920	4508	regsvr32.exe	87
PID 4508 wrote to memory of 3920	4508	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1b6d0e044569310fdbcbfe6d3780f605.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1b6d0e044569310fdbcbfe6d3780f605.dll
  2⤵
  PID:3920