d451f6bc38ae71eccde50310507a91527714d64bec4aa4cdba613983a75145e1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 11:31

Target

$APPDATA/operations/vbamnu.dll
Size

29KB
MD5

2e8811916b23afa369b0a1584d95086e
SHA1

6887c697e59766859cc561a751adfda3a9140e63
SHA256

687db98b6b8cf42dae4c2ea7e50e149c9b79e61bd48d5f806ebc042fb2ed09ad
SHA512

cca9270aa9782afe5291f17517cb89dce94371003af44824f5a7ed5d7efae7c8ebeac30bd58834d34783ca53fb6507b7556943b4e75bb0b1c22a90cb5b8c97a0
SSDEEP

384:VIy3T9VTvHyc/x8KmtzFCtoLKaGpQxvwMT5fy0DT1HGMAFZCap6/b/0dD0L6Kq0M:VIycKmtMt8uWp1VtHGPvKMZ0Rq0xxoX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 336 wrote to memory of 4252	336	regsvr32.exe	regsvr32.exe
PID 336 wrote to memory of 4252	336	regsvr32.exe	regsvr32.exe
PID 336 wrote to memory of 4252	336	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$APPDATA\operations\vbamnu.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:336
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$APPDATA\operations\vbamnu.dll
  2⤵
  PID:4252