051a80a2a82dd18faa9d0738c5403f3f0dbd0926e0525a445596cc6ef2d7d754

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 23:51

Target

$_2_/tnproxy.dll
Size

707KB
MD5

3bad47f1e11387358ba090fbc2682713
SHA1

e7e7843d3fd4f45fdb65ff40936bc28a10651589
SHA256

26c906e83d280f03e021a5730908cc40551f8ef98e048b9ae001354ec83ae736
SHA512

c00f7079746cc0ab961680ca784cac036ad60c2883e032fea9d8ac4791579f5cb952a341efb0068a38f81ab84c6dc870ddd8ae5ddb66d17a812a80fc8e1486eb
SSDEEP

12288:aY2sKZ+fh+jtdwPBAMvyAXlOsJhYV0J7OQf1LoP+MmIlF/w2MfNXn0K43qsvXB3p:h2sKAj5YV0J9UWrkxPHRzANe

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4444 wrote to memory of 2276	4444	regsvr32.exe	regsvr32.exe
PID 4444 wrote to memory of 2276	4444	regsvr32.exe	regsvr32.exe
PID 4444 wrote to memory of 2276	4444	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$_2_\tnproxy.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4444

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\$_2_\tnproxy.dll
2⤵
PID:2276