018053c47b5283e84878b422306a0c44855aa62818924a8f16be5076eb30d12d

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 06:06

Target

2b28ec67b238aa06ab5bd86d6758705a.dll
Size

35KB
MD5

2b28ec67b238aa06ab5bd86d6758705a
SHA1

b1e287074d70b121993b172e6db4743c6a73eabc
SHA256

018053c47b5283e84878b422306a0c44855aa62818924a8f16be5076eb30d12d
SHA512

504416e2269390589fdba6aa46de95293a35717aeff7b0cf29543035b863e112b49f9857c7c0c9cc4cc30d9e0106f1896ada796a82be0348aa08bcaefd0e48d2
SSDEEP

384:+d+k6d9hJyM2hNx4hHnaVswXA7+2S8nMTCZdT1nfBc+Z2tYpcqeIDyS35RsmdK83:8+v9hqO4g1T1f1Z2uFrNDWwQ1Pi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 4480	3768	regsvr32.exe	88
PID 3768 wrote to memory of 4480	3768	regsvr32.exe	88
PID 3768 wrote to memory of 4480	3768	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2b28ec67b238aa06ab5bd86d6758705a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2b28ec67b238aa06ab5bd86d6758705a.dll
  2⤵
  PID:4480