2470657df3e276c4a458ad9a57f00bc30b46faf4689225a7826e2da22ab53cf8

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 04:32

Target

9ac2f7f8669312831e9976e8eb65b70a.dll
Size

26KB
MD5

9ac2f7f8669312831e9976e8eb65b70a
SHA1

13fc08a7055d8339cdbec13a2519d405c6492d5a
SHA256

2470657df3e276c4a458ad9a57f00bc30b46faf4689225a7826e2da22ab53cf8
SHA512

65f713bd93bc52f002a5e4a9593ec4cb0ca28ae3ba06a41ea9c2ec3baa0354dd56ed71272830a45e797f9dfcbbca0ac766957bb3fb877feb4fe758fe4ec7227a
SSDEEP

384:e7dxz0CKAoqd+13XQaFt5svs9fezmrgOhe2kZnATPaStwSb4Ku+HTqAzWrtQjJZn:egCKBqdSHQSfh9flevVSaLEueWrtmZII

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 4760	3996	regsvr32.exe	83
PID 3996 wrote to memory of 4760	3996	regsvr32.exe	83
PID 3996 wrote to memory of 4760	3996	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9ac2f7f8669312831e9976e8eb65b70a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9ac2f7f8669312831e9976e8eb65b70a.dll
  2⤵
  PID:4760