d7e11b178fcc3d1ee7f6ad3dce6da2ea043de64d521cf3578fb09031cbdb0ae2

Analysis

max time kernel
91s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 15:37

Target
$R0.dll
Size 33KB
Sample240508-s2wayadh78
SHA256 c085caea2677b0eeaeecb9afe7e0bad83c2a94fc78d5c3f7819bc7314e54ec69
MD5 c0280971a69869d7a1f3b35793c839f3
SHA1 946356173bdd7d575db1d1b3fb04ed81353e098a
SHA512 cdd1530aec393c9c07574e9a32214af8fb5eef85a5be02db68e24e05c5e1d88449f064e280d2bcd21aa6921c7545f30965a6724ce810960001964a3c558370ba
SSDEEP 768:i2/5ZWpdwrGUxnyiehH/kmjGyhYlaygOENAMxjI:RBZWpvWa5jrYlNixjI
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 2660	3344	regsvr32.exe	82
PID 3344 wrote to memory of 2660	3344	regsvr32.exe	82
PID 3344 wrote to memory of 2660	3344	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$R0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$R0.dll
  2⤵
  PID:2660