0e236702be7fd4668bc301423545c99014dac5acab17f7fcc1917bd094ec1dd8

Analysis

max time kernel
143s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 02:43

Target
713cc7a1f5d034dd772f24ffe5c73d44.dll
Size 84KB
Sample240124-c7pgksgfe6
SHA256 0e236702be7fd4668bc301423545c99014dac5acab17f7fcc1917bd094ec1dd8
MD5 713cc7a1f5d034dd772f24ffe5c73d44
SHA1 a0d16c6d195f53c1e2ed09d7723eb783ff32b981
SHA512 49d1e3c9549f40bb825bb6eb4a1d56cdc9318a0072b4d1ae94ba9655dad01848a76e065579df94f93c5b1893c06b4bc5a02875cc8ef5d20c4c24413c33ea00c3
SSDEEP 1536:XGFqRQJ1uy1UTva1+Aqx5Ip3jRMyU0701X0x0mF1KEhgxpBn0qZ3K4yW:rs1u8Uk+dTIR9MyU070KxrPU0qZ3K4yW
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4060	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 4060	4032	regsvr32.exe	86
PID 4032 wrote to memory of 4060	4032	regsvr32.exe	86
PID 4032 wrote to memory of 4060	4032	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\713cc7a1f5d034dd772f24ffe5c73d44.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\713cc7a1f5d034dd772f24ffe5c73d44.dll
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4060