dc612d42a9f81b79b71b41f4b58a5b100867863891b8fbe55f4c68e769e0e663

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 01:35

Target

4cfede181852a5120754f906ea142519.dll
Size

43KB
MD5

4cfede181852a5120754f906ea142519
SHA1

6303dd10d01c156bb1401e1b571051c46093c7dc
SHA256

dc612d42a9f81b79b71b41f4b58a5b100867863891b8fbe55f4c68e769e0e663
SHA512

4005279bab44e9009bd1987cc0a3ac33768596ba7b16fb8bfabf5e9cc528a8f8d0f7dd49d80e8e5c4bd082588a2d38d362ffce650cd53e528906d1fa8cf159ee
SSDEEP

384:yKUx0C05HqMlQSyvFfGNJdTqe8QZB6HLQzC4/Y6X7QEW2QUZTJ4fCSYz5PwErLjb:hCYqEQ9vUr8QDQLWU6LZQigRpidnBso

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 4332	208	regsvr32.exe	16
PID 208 wrote to memory of 4332	208	regsvr32.exe	16
PID 208 wrote to memory of 4332	208	regsvr32.exe	16

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\4cfede181852a5120754f906ea142519.dll
1⤵
PID:4332

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4cfede181852a5120754f906ea142519.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:208