be92ef6e4d6db34dd6396d800f38f4e0eea46a8748fa8564ee40d975c9798fb7

Analysis

max time kernel
92s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 19:59

Target

a29fbbc6594b104c0f161b0cedd5e2f0.dll
Size

24KB
MD5

a29fbbc6594b104c0f161b0cedd5e2f0
SHA1

01de62d2430b0748ea7cc522ef5c508c5337c47b
SHA256

be92ef6e4d6db34dd6396d800f38f4e0eea46a8748fa8564ee40d975c9798fb7
SHA512

5487d3517bf6c40b84fed3f333da35d0699861e8a4b6ccc7e61bf2d8768cc4105b8ccec6d77c658f3b325be8bd6c16f6c23bf4863d994eac28ba87caab7ed33c
SSDEEP

384:uGKudT12WdMCpsjgTO5NdixBSlchSsT8pxs7Trjff5WVwcFsrd4/Fgb4:uzu71Mea5NdixBSOT6xarj0L/Fg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1696	1064	regsvr32.exe	76
PID 1064 wrote to memory of 1696	1064	regsvr32.exe	76
PID 1064 wrote to memory of 1696	1064	regsvr32.exe	76

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a29fbbc6594b104c0f161b0cedd5e2f0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a29fbbc6594b104c0f161b0cedd5e2f0.dll
  2⤵
  PID:1696