49e6d400af1293ea416f81d26f66854c2982795aeae0dbe23f98b4579b90a4f5

Analysis

max time kernel
142s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 03:23

Target

5559c3ee4499ab044c96dd3ce525528b.dll
Size

103KB
MD5

5559c3ee4499ab044c96dd3ce525528b
SHA1

1151de8a408548537b2e0a69b95404856cd9dc31
SHA256

49e6d400af1293ea416f81d26f66854c2982795aeae0dbe23f98b4579b90a4f5
SHA512

2d0d6402c9c07af63b4c6a345aa7807354ad473d8aea5a68168e8da291abb08d41553a1a141fac1da2d195de87b83b5807bff473a24907b140f7a73e0072e358
SSDEEP

768:dCQoi6qZOMQOppibaZXYTq45AOUdQwk2lxeZO0neunVv+JNgxZ9+6cczruNiO4/k:dCQv6qZpQc7sqClolx10v+KZ9mcbIYC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 3584	5088	regsvr32.exe	13
PID 5088 wrote to memory of 3584	5088	regsvr32.exe	13
PID 5088 wrote to memory of 3584	5088	regsvr32.exe	13

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\5559c3ee4499ab044c96dd3ce525528b.dll
1⤵
PID:3584

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5559c3ee4499ab044c96dd3ce525528b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5088

memory/3584-0-0x00000000004F0000-0x00000000004FE000-memory.dmp

Filesize
56KB

Download