0dca8aa6535dc6c206e2896bc5c6bf93f5867a7a03d71674dac9417d7c94d092

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 03:40

Target
5a2e38fa38f10106cb19594fb4ac45f0.dll
Size 91KB
Sample240114-d799qacea6
SHA256 0dca8aa6535dc6c206e2896bc5c6bf93f5867a7a03d71674dac9417d7c94d092
MD5 5a2e38fa38f10106cb19594fb4ac45f0
SHA1 7cd7e4bd8d48006706737c0ca8bb2401fb50a237
SHA512 e98bab747624dd3e198e7ba2f1f3a056f49ed2ea635aeda5a55b235eaaf6dad8f1138e5491621ea27f8cf059668a8ddaf72307bec0edf07ba65308e106379ae4
SSDEEP 1536:3HurmOD7cP2efOHvN54WxKLZ7y0goHC0aw1NYZMOqHia0LEWSX:3OzDRgOPv4WxK9xEiOqH/04p
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2656	2500	regsvr32.exe	87
PID 2500 wrote to memory of 2656	2500	regsvr32.exe	87
PID 2500 wrote to memory of 2656	2500	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5a2e38fa38f10106cb19594fb4ac45f0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5a2e38fa38f10106cb19594fb4ac45f0.dll
  2⤵
  PID:2656

memory/2656-0-0x0000000000400000-0x0000000000446000-memory.dmp

Download