2ba898c8a15f1e8e794649adf5b33cb6441061b0cf5004d184faff9ce6f81002

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 03:41

Target
4a581fb9d84e2ff55ac3f6c2c7248531.dll
Size 20KB
Sample240108-d87vzsaebm
SHA256 2ba898c8a15f1e8e794649adf5b33cb6441061b0cf5004d184faff9ce6f81002
MD5 4a581fb9d84e2ff55ac3f6c2c7248531
SHA1 3eac4c4b992f116cea8e180b56d1fb42d8cb94b3
SHA512 614ae8bc84ce3f1028931bf7273ac3a64a077c4846c0453dfae9df63ab2b1c1932a0e296ee995365f7d8522887a56ef7512acfdc9484018b1f6f3ef068039c32
SSDEEP 384:I9RdCyPMqlW4mQm6NPoTkEFRrGxoq/cGmWzAztu/i6d:2Cykql9mQRFuAxzEh/tua
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 4976	2948	regsvr32.exe	40
PID 2948 wrote to memory of 4976	2948	regsvr32.exe	40
PID 2948 wrote to memory of 4976	2948	regsvr32.exe	40

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4a581fb9d84e2ff55ac3f6c2c7248531.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4a581fb9d84e2ff55ac3f6c2c7248531.dll
  2⤵
  PID:4976