754e8dbc36cc233f9fb046a162367da005732e6d477d6fa7e9bc4254d2583164

Analysis

max time kernel
148s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 13:54

Target

c0c11d9860b5cc431ce7646fa9c81ea3.dll
Size

66KB
MD5

c0c11d9860b5cc431ce7646fa9c81ea3
SHA1

487783e6431c7b10a3075145e213521ddcc12232
SHA256

754e8dbc36cc233f9fb046a162367da005732e6d477d6fa7e9bc4254d2583164
SHA512

a633af2a97221a07943088e52dc622468ebdcc7bfee64c0f89ac28a2f09fe1858c3479c7e56bc2dc880c7e659920fdc1e5f29adb6c4e3b27720ccf2281b9f929
SSDEEP

1536:7MesVWaJk/hKXwFXw3mxeHi/rqIdJKkFc4w8ZPe87W0eRhso:7MbVG/hKX0UfC/rtPFc4TxLWDio

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 4336	4348	regsvr32.exe	87
PID 4348 wrote to memory of 4336	4348	regsvr32.exe	87
PID 4348 wrote to memory of 4336	4348	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c0c11d9860b5cc431ce7646fa9c81ea3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c0c11d9860b5cc431ce7646fa9c81ea3.dll
  2⤵
  PID:4336

memory/4336-0-0x0000000001F60000-0x0000000001FA7000-memory.dmp

Filesize
284KB

Download
memory/4336-1-0x0000000001F60000-0x0000000001FA7000-memory.dmp

Filesize
284KB

Download
memory/4336-2-0x0000000001F60000-0x0000000001FA7000-memory.dmp

Filesize
284KB

Download