d21665dfe3585e46c95bfe5ba45495e8ceccce3e2bc92fd993bbfaa011a216a5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 18:54

Target

I386/SYSTEM32/DESK.dll
Size

87KB
MD5

196d6d11361aa73199d16c167b9290de
SHA1

316ef1cac93d7afbcb8208f7d535b16c1b7340ce
SHA256

64fecb5c1015fe7db9cfabc6924b96a63fc23fa7fa9ac0e9368458002d3dc683
SHA512

a7d5b1e4bf7805cd3086b5b6f9fe0dcd8713d156c9db5eb548da668200a755cf894e18ffb26c5413b7b01db67bccd704b3bf5e1715795a0a4b954dba3c769e65
SSDEEP

1536:eeJqywKJtxzEpVVJmylGadxIFcmIEjIFfDzurvX2XIFcDIElIYfDzwrOXbRD:eeMywKJgp9r8avIF/IEjIFuP+IFyIElz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 3576	4040	regsvr32.exe	83
PID 4040 wrote to memory of 3576	4040	regsvr32.exe	83
PID 4040 wrote to memory of 3576	4040	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\I386\SYSTEM32\DESK.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\I386\SYSTEM32\DESK.dll
  2⤵
  PID:3576

memory/3576-0-0x0000000058AB0000-0x0000000058AE6000-memory.dmp

Filesize
216KB

Download