a4c6eeed1631fa8fda0eb3abebdc8cacc678a145788dab5debfb4d66092f85c4

Analysis

max time kernel
92s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 17:04

Target

ac664e07bec7caa3c3a85d98903131b3.dll
Size

33KB
MD5

ac664e07bec7caa3c3a85d98903131b3
SHA1

f637905e8416abebe6ea1de113d332280087eaaa
SHA256

a4c6eeed1631fa8fda0eb3abebdc8cacc678a145788dab5debfb4d66092f85c4
SHA512

42fc457195857e08dae361c29521c6cdc8a944a13380c66abb7f430fb082a620e470863fd1b606727e465218786d9d9e46da072adf69f01b89dbeaaf41c1fdc7
SSDEEP

768:9ehypCHCOii3RSjyoBxhJrhUomTzVVPRfns7Rp6vTWwH71Lyg:9/kHzii3RSjyyxDrhUfXxqcvf71Lyg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2152	1944	regsvr32.exe	88
PID 1944 wrote to memory of 2152	1944	regsvr32.exe	88
PID 1944 wrote to memory of 2152	1944	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ac664e07bec7caa3c3a85d98903131b3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ac664e07bec7caa3c3a85d98903131b3.dll
  2⤵
  PID:2152