566fb57ced31f6457986f260cd74797a4a4f07b86263326490f0588cb2b3576d

Analysis

max time kernel
122s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 14:22

Target

39ab17b943c73cc91b88475f3c6607a3.dll
Size

213KB
MD5

39ab17b943c73cc91b88475f3c6607a3
SHA1

d8447022dd66badd9239510d5fd75a700e3fc51d
SHA256

566fb57ced31f6457986f260cd74797a4a4f07b86263326490f0588cb2b3576d
SHA512

543b3fb6037a51a0f3858c2d58e566b6819802ae11c667850a30e088ae86633f4805c760f6a0380dccba6387a5c8d8383e0a8dd49d8c1df9556f264353ea539c
SSDEEP

3072:txICUuxICUuxICUuxICUuxICUuxICUuxICU:TICUGICUGICUGICUGICUGICUGICU

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2644	2760	regsvr32.exe	89
PID 2760 wrote to memory of 2644	2760	regsvr32.exe	89
PID 2760 wrote to memory of 2644	2760	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\39ab17b943c73cc91b88475f3c6607a3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\39ab17b943c73cc91b88475f3c6607a3.dll
  2⤵
  PID:2644