013f49b1709a70e58968ff552cfdce0fa9903dfd276e5b092a23a05a782f5db3

Analysis

max time kernel
93s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 18:17

Target

ArmAccess.dll
Size

52KB
MD5

c841204b08d5a330f4e0503430f82e24
SHA1

5720d7eba4fdae55a7e67cfe3637cfda02d2e953
SHA256

089869db6efb52ce41dc6f0ab859164c7a316f4ae082cdc45b1ea7921fd42505
SHA512

22542300bc25ea84906c2ec7fd0588a9be67f9c44732f1c9c3ac8f2049a1941f2c746888c5635beb6a00049743cbb322143d698af7d501e9f5fc17738900e9ea
SSDEEP

384:TWNNgJdY59tTulkbETxYpx6y2LfiqoYBUcz837yIYh9JzxovS1f2uUIiho38oqee:SIwTulXtkmfZBe7EtFovs2I38ozSihb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 3140	756	regsvr32.exe	86
PID 756 wrote to memory of 3140	756	regsvr32.exe	86
PID 756 wrote to memory of 3140	756	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ArmAccess.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ArmAccess.dll
  2⤵
  PID:3140