e01416654a077036eb0cc53c329c6ad64173e78ef85efa9166212397ff9f0090

Analysis

max time kernel
139s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 11:50

Target

971637360c181a779e3dc7112672a0e6.dll
Size

31KB
MD5

971637360c181a779e3dc7112672a0e6
SHA1

3e8fe64ed0dee15dda92373e6399f395d5e8f9aa
SHA256

e01416654a077036eb0cc53c329c6ad64173e78ef85efa9166212397ff9f0090
SHA512

7641ffdd7725c37751bc1550164d9a6cfe5b4fd89d289b2f75111bb127c679f3e56067d1d8461aea181cb2c028a934f1c7ce7ed05cbc8f2a745faab886d4d71c
SSDEEP

384:PCNe0cVyphzLpCgnqv68c8bIYb3mtnSvHTxCvV48lWH/p1iDbuEGJ8Q8Spvk:4ehyp6gqRViJSoJl2BknuEGJEJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4948	4908	regsvr32.exe	83
PID 4908 wrote to memory of 4948	4908	regsvr32.exe	83
PID 4908 wrote to memory of 4948	4908	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\971637360c181a779e3dc7112672a0e6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\971637360c181a779e3dc7112672a0e6.dll
  2⤵
  PID:4948