f3af83745e63086f4cab002198d0be3da234cd580ca4ced485ae853b3e5191dd

Analysis

max time kernel
92s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 22:11

Target

9a0a3646cb44e51fc6310eb8ff922214.dll
Size

160KB
MD5

9a0a3646cb44e51fc6310eb8ff922214
SHA1

a038e92ff3451f9e7ba76414697801f0aac4cad3
SHA256

f3af83745e63086f4cab002198d0be3da234cd580ca4ced485ae853b3e5191dd
SHA512

45c342809c7aa176c4e9507147f15163e1fb2db1740ebd538192742ce6c3bafa7439504e569baf5ec79d869392d7d0734ab165bfc9726ad28e286881a3d220d7
SSDEEP

1536:9AhdW7+GHSRaBjffOt0E4uTQmXg2f6Dv9HCsICS4AIZ2PGvkoNLaQS8FnRJBmwf3:+WpHSgrWtwQ+HCHOZ2PGvkosQSWnRbv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 3884	3836	regsvr32.exe	85
PID 3836 wrote to memory of 3884	3836	regsvr32.exe	85
PID 3836 wrote to memory of 3884	3836	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9a0a3646cb44e51fc6310eb8ff922214.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9a0a3646cb44e51fc6310eb8ff922214.dll
  2⤵
  PID:3884