bff57ccfbe2690d2b35717379b6c6902270dba122a8d508457124c073eaffd0e

Resubmissions

02-02-2024 14:59

02-02-2024 14:53

max time kernel
450s
max time network
451s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2024 14:59

Target

IScript.dll
Size

232KB
MD5

742679327ee56723096eb5aa5928be26
SHA1

20c6d65b0ae8e5e98198cf6dc993c60ada1d6553
SHA256

9fae0665d7b6d21a93a73708249bd44337910cf4f32210c584eda24733cacf7f
SHA512

05fa9e09fa3fd114eb1dbb96f27c680d78a82e318731a81174e68fe559e1d9f1b3565f2e7eff6b838ed41a429fd00577f2bb5885015bc68bb04d0f97c3150bf1
SSDEEP

3072:tn+NO80l7dwCkl9n4G2hxIDXTDooqcQNiplc8uX4jBSa6YTOzDx/iTEJuJIcQVxo:1Ovfb0NiplcYlob1gOHxDQt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1756 wrote to memory of 2564	1756	regsvr32.exe	regsvr32.exe
PID 1756 wrote to memory of 2564	1756	regsvr32.exe	regsvr32.exe
PID 1756 wrote to memory of 2564	1756	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\IScript.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\IScript.dll
2⤵
PID:2564