b3eb161ce5d471f388a221ece69ca1c67eeec17e0321a8c4a60d3c4382dbdac1

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2024, 02:41

Target

d7ae0fd94757731b354e095918d5bf9b.dll
Size

217KB
MD5

d7ae0fd94757731b354e095918d5bf9b
SHA1

71d78dca21ca45801a58b240ff76ab733ed4d929
SHA256

b3eb161ce5d471f388a221ece69ca1c67eeec17e0321a8c4a60d3c4382dbdac1
SHA512

c28359994ff7e27b4de0323da981694f0e34a617302d5b573ab2a2d25ebde7da45367ca9804a1b69a7b0d23eaa8f413ce6d1dba93b59c185a3a3aa02f9ee169d
SSDEEP

3072:0nrTYOnrTYOnrTYOnrTYOnrTYOnrTYOnrTY:0nrTTnrTTnrTTnrTTnrTTnrTTnrT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 2316	4736	regsvr32.exe	89
PID 4736 wrote to memory of 2316	4736	regsvr32.exe	89
PID 4736 wrote to memory of 2316	4736	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d7ae0fd94757731b354e095918d5bf9b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d7ae0fd94757731b354e095918d5bf9b.dll
  2⤵
  PID:2316