5dbe59453affdbdc633604298c2cfe56d2b6000e12b497db0ca7f9a857e1c948

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 22:03

Target

5dbe59453affdbdc633604298c2cfe56d2b6000e12b497db0ca7f9a857e1c948.dll
Size

61KB
MD5

934143cdd3a4f3572a3281294dfb2003
SHA1

7179c9eaa09685ac063c32d03dc411b17256821d
SHA256

5dbe59453affdbdc633604298c2cfe56d2b6000e12b497db0ca7f9a857e1c948
SHA512

cb0d64888afaec87e453bb61e45efd4af0ee72005dc6b710374b7da99f4e815a2d05750079b1bdb3b76ad20cd25f7bdceb44ec3097e9ee498369208558214cd5
SSDEEP

768:IwyfocomSpfS6q4AIbopY920AzF5vysJoG0sUOh7dm411D4aDzhgpumEcY+ESqKd:Ifp4AIbopsAzOs6c//1D1gAdpSqKW5K

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 4120	4016	regsvr32.exe	85
PID 4016 wrote to memory of 4120	4016	regsvr32.exe	85
PID 4016 wrote to memory of 4120	4016	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5dbe59453affdbdc633604298c2cfe56d2b6000e12b497db0ca7f9a857e1c948.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5dbe59453affdbdc633604298c2cfe56d2b6000e12b497db0ca7f9a857e1c948.dll
  2⤵
  PID:4120