1448aec568bd15a5df6a67fe357d65310426ffc7c02c11b7b10767a4ef7a7cae

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 13:45

Target

98b9bd9da1ad5c48dc82f3c7152494217823514b5fc6d5b8e53b9b5a8dec5f7a.dll
Size

167KB
MD5

fe43e3595e8e79f086fe9b367e8d7005
SHA1

fbc5f7531e7dd3969e41b81c77c91f93ab5625d4
SHA256

98b9bd9da1ad5c48dc82f3c7152494217823514b5fc6d5b8e53b9b5a8dec5f7a
SHA512

781442da825d382964747248cc2162fad7afabfa97069a0eda7da04fe2578de9ab6b4e90d00272c67ad00a117f8fc62519e7aaab1b58adc253165a8d29325fde
SSDEEP

3072:gab7+a6RKcswmok6hxrFO/DjPehy+e6kylW8G:fQ1sw7hxZObqX3

Score

1^/10

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4824	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 3776	4824	regsvr32.exe	86
PID 4824 wrote to memory of 3776	4824	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\98b9bd9da1ad5c48dc82f3c7152494217823514b5fc6d5b8e53b9b5a8dec5f7a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NHFHYHo\qNkq.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3776