6f40c5eb65500c87e57bd02e7d6fc9a6585f9d335a9db123913c1b64ab8b640d

Analysis

max time kernel
0s
max time network
9s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 16:45

Target

87636c469c74de0fa82ca17741e74645.dll
Size

179KB
MD5

87636c469c74de0fa82ca17741e74645
SHA1

b4e0506496c402a7b2b642c4420dc4226d8fb62c
SHA256

6f40c5eb65500c87e57bd02e7d6fc9a6585f9d335a9db123913c1b64ab8b640d
SHA512

abefffd00c621323632009572b72dbdf323b2db171c34fb6542b9f6dfab4024fff3a8aafdbe54cff11387e6afc183e94d5165c109dd083a0d9e82ebe396a399e
SSDEEP

3072:1c03aPWOfQLiy8dZiMa4bbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7UrfmY:taGteZirWwvP6bQ7yMP+DE8278cE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1040	1236	regsvr32.exe	85
PID 1236 wrote to memory of 1040	1236	regsvr32.exe	85
PID 1236 wrote to memory of 1040	1236	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\87636c469c74de0fa82ca17741e74645.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\87636c469c74de0fa82ca17741e74645.dll
  2⤵
  PID:1040

memory/1040-0-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/1040-1-0x0000000001210000-0x0000000001240000-memory.dmp

Filesize
192KB

Download