73a04835ad6b18d320079a7f0afdc2497e74fb45cec3259b2b04e6d302fa6549

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 14:34

Target

73a04835ad6b18d320079a7f0afdc2497e74fb45cec3259b2b04e6d302fa6549.dll
Size

5.2MB
MD5

259e4b7f22536043c94dd175bcc060d9
SHA1

c567075b45597b6029888010f6686f9c690bdc66
SHA256

73a04835ad6b18d320079a7f0afdc2497e74fb45cec3259b2b04e6d302fa6549
SHA512

1bb2bc3f304bb89ab1c1fb3b89d45cfdf40d6b64fb8a54a4e7bf539fe36fc28c676deb7c35a31d4c1dbfd49cd36b957911ce1661f19fce18a45b98f423eb0ef4
SSDEEP

98304:v9EeMbvS/IQUHrcboG54wzq+kc3r5atta49FXAgWyl:v9TMbvS3UHrcsB+kcMAgBl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4692	4492	regsvr32.exe	85
PID 4492 wrote to memory of 4692	4492	regsvr32.exe	85
PID 4492 wrote to memory of 4692	4492	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\73a04835ad6b18d320079a7f0afdc2497e74fb45cec3259b2b04e6d302fa6549.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\73a04835ad6b18d320079a7f0afdc2497e74fb45cec3259b2b04e6d302fa6549.dll
  2⤵
  PID:4692