e61b0af971c29c59f677e434afaaf29edb2e4573ae05a52a83abd20d562940ca

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2024 15:50

Target

7d6066917c81ff22a89901298a4cdf3d.dll
Size

356KB
MD5

7d6066917c81ff22a89901298a4cdf3d
SHA1

e69e384679fd51da634097f596ec393da0b49e18
SHA256

e61b0af971c29c59f677e434afaaf29edb2e4573ae05a52a83abd20d562940ca
SHA512

9cb207f853acce2736338378042563fc325dcf8b25184602a8716e78b9a2735ab51c42a749badedfbcd9253f322272c54ebd1e6ba270d9d689ab1564a58d5c6e
SSDEEP

6144:4iG4vu8ZPXk1YOWkHwzU9qUTCmyQQEsC+SWQeOOSxp6piG4vu8ZPXkbA9R9:y4lxTOWiUU9q1hbV4lxpP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 3412	2752	regsvr32.exe	84
PID 2752 wrote to memory of 3412	2752	regsvr32.exe	84
PID 2752 wrote to memory of 3412	2752	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7d6066917c81ff22a89901298a4cdf3d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7d6066917c81ff22a89901298a4cdf3d.dll
  2⤵
  PID:3412