3f77641a01107b6c1ed3098eb3565546ce46f996907dfabd6d946a1c611f9ba8

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 17:21

Target

8ce772a1c30297595708b5f44ff618c2.dll
Size

140KB
MD5

8ce772a1c30297595708b5f44ff618c2
SHA1

5ad2e28af9505f24a4395469f0dad66e1aa48ef3
SHA256

3f77641a01107b6c1ed3098eb3565546ce46f996907dfabd6d946a1c611f9ba8
SHA512

0531120ea1b53371f5a03eba399fedbb487b877b69b351e066b619e19ddf6f9bfba64ad29436c6d290d46c51c22636bae3ae16c8b63d1b085bb5f080359b00e6
SSDEEP

1536:kR8hbwrP95HG+7lHGZ9LjTGCXdRPF0h8k79Pl5E0HW6HKkDYJEbDwrO4E:GzvyZc+RPFidkGuEbDwy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 2144	1556	regsvr32.exe	84
PID 1556 wrote to memory of 2144	1556	regsvr32.exe	84
PID 1556 wrote to memory of 2144	1556	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8ce772a1c30297595708b5f44ff618c2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8ce772a1c30297595708b5f44ff618c2.dll
  2⤵
  PID:2144

memory/2144-0-0x0000000000660000-0x000000000069F000-memory.dmp

Filesize
252KB

Download