41beb20f99d33285c116e95e1412b0d8e29dad50f50e45e7f807cc29b89da6b9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 11:32

Target
ae68fb6423adfdb9f3c1ba0e7f8e88ed.dll
Size 664KB
Sample240229-nnhepsfe8v
SHA256 41beb20f99d33285c116e95e1412b0d8e29dad50f50e45e7f807cc29b89da6b9
MD5 ae68fb6423adfdb9f3c1ba0e7f8e88ed
SHA1 f27319a30eec1d14aed1ac3f68aa9324b89c8a7e
SHA512 1f656c3cebbdc295db28b284e6a23ce284cd85399f8a589fd74cbbe9ba523f6ade4bd4a9f20b33cd24e6fc1325fd25d5ca1c34f5485919a16c2d743b8b339596
SSDEEP 12288:2si5g4y9f2QPRmxiDozjLst4kY/P5+YuaVaYlIALrDbzeZ5ea4HMn:2mxFT4jP5+titlJrDWx4K
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4392	4964	regsvr32.exe	88
PID 4964 wrote to memory of 4392	4964	regsvr32.exe	88
PID 4964 wrote to memory of 4392	4964	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ae68fb6423adfdb9f3c1ba0e7f8e88ed.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ae68fb6423adfdb9f3c1ba0e7f8e88ed.dll
  2⤵
  PID:4392