0e54384aca82605e47118d1530de684f49f1fec55a897b9d3692deffa284e44f

Analysis

max time kernel
131s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 07:57

Target
5ab56fff7dfa224d90c7f55fcc9d7ea6.dll
Size 231KB
Sample240114-jtk1kaefck
SHA256 0e54384aca82605e47118d1530de684f49f1fec55a897b9d3692deffa284e44f
MD5 5ab56fff7dfa224d90c7f55fcc9d7ea6
SHA1 bc7ec683f10d6cc948cba4134afb94aba207802b
SHA512 062b9872d694e7d51bc4e59cdea01e55aa9228f2e1bce2a9c31285cb98227c52d24f9ef32da18ec57d16722ce36d8c34d4dcc9d8c34a6b0a589a51e1e701d24d
SSDEEP 6144:3ZppW9FZppW9FZppW9FZppW9FZppW9FZppW9FZppW9:3ZpuZpuZpuZpuZpuZpuZp
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 5072	2404	regsvr32.exe	89
PID 2404 wrote to memory of 5072	2404	regsvr32.exe	89
PID 2404 wrote to memory of 5072	2404	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5ab56fff7dfa224d90c7f55fcc9d7ea6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5ab56fff7dfa224d90c7f55fcc9d7ea6.dll
  2⤵
  PID:5072