15ed99495a67533ca08b4889c1122fb438fe27593ae60c7d7e123bbcac5f2748

Analysis

max time kernel
142s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 04:35

Target

28609e1ac70c295552cc83c890e82e6e.dll
Size

88KB
MD5

28609e1ac70c295552cc83c890e82e6e
SHA1

077cacf38c094a76efe9400cde4345b0a20a1269
SHA256

15ed99495a67533ca08b4889c1122fb438fe27593ae60c7d7e123bbcac5f2748
SHA512

d81bc3ce08df8eeb89284f0f2e39f01e3d03e0fb11e1563e788f22ece1ebe31180d6de905cf5fc5dc27604b4e12f03ac71a62438d491d0630e986c5775a9fad7
SSDEEP

1536:ordJRRNC7Zxt3b+QB+xe8HqtIWJC/jv79aIqiHgELIAY87:m07ZxEtMvtIa+jEID1LIAY87

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 1660	4996	regsvr32.exe	15
PID 4996 wrote to memory of 1660	4996	regsvr32.exe	15
PID 4996 wrote to memory of 1660	4996	regsvr32.exe	15

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\28609e1ac70c295552cc83c890e82e6e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\28609e1ac70c295552cc83c890e82e6e.dll
  2⤵
  PID:1660