f6eeb8e857cc00a704a38d033b40cf97d58db553cb57208193c8f6b8ae2ed655

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 16:04

Target
b7cf7c56bcebb82ed5a35eb93c607ec1.dll
Size 664KB
Sample240306-th4cwach7s
SHA256 f6eeb8e857cc00a704a38d033b40cf97d58db553cb57208193c8f6b8ae2ed655
MD5 b7cf7c56bcebb82ed5a35eb93c607ec1
SHA1 810ca7199c63b15880f2d4917398737d79892e99
SHA512 d145ceab0b4ba4f31bfc957c52f21aad88d408baf30150d26c79cef8c1d1d601c1d1a99332684e2e33cf286c4028c211948d7e3aae0e904686ce3c6c29e80fa5
SSDEEP 12288:2si5g4y9f2QPRmxiDozjLst4kY/P5+YuaVaYlIALrDbzeZ5ea4HMg:2mxFT4jP5+titlJrDWx4h
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 2212	3216	regsvr32.exe	90
PID 3216 wrote to memory of 2212	3216	regsvr32.exe	90
PID 3216 wrote to memory of 2212	3216	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b7cf7c56bcebb82ed5a35eb93c607ec1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b7cf7c56bcebb82ed5a35eb93c607ec1.dll
  2⤵
  PID:2212