e94a0755987bb3977a1f0ada08c3177402d7c2e0c9bccdaa970a3c3841c8bca7

Analysis

max time kernel
128s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 22:26

Target
9a1234604be7cf30f1fe8314f7e7d27f.dll
Size 410KB
Sample240213-2cscesae31
SHA256 e94a0755987bb3977a1f0ada08c3177402d7c2e0c9bccdaa970a3c3841c8bca7
MD5 9a1234604be7cf30f1fe8314f7e7d27f
SHA1 b6beea547c5f41ed7de87ce5c1a29b502470ec75
SHA512 831f963f711003bb244c0113c85ec825f526e649cd85f942eea799cda40b203405f29b72c7a4d10ee4a2e7feeb6dfa9be97b083f8ce88a6594d75137ae4ecff0
SSDEEP 12288:uENyYu8Qqz4miF5T/KUhLKH4JCndQi32F8y:ueZnD3YIn2f
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 1348	3692	regsvr32.exe	85
PID 3692 wrote to memory of 1348	3692	regsvr32.exe	85
PID 3692 wrote to memory of 1348	3692	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9a1234604be7cf30f1fe8314f7e7d27f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9a1234604be7cf30f1fe8314f7e7d27f.dll
  2⤵
  PID:1348

memory/1348-0-0x0000000000400000-0x000000000046A000-memory.dmp

Download

memory/1348-1-0x0000000000400000-0x000000000046A000-memory.dmp

Download

memory/1348-2-0x0000000010000000-0x0000000010065000-memory.dmp

Download