a87cb54986607413406f6f3e5b5b314b3871080658f5e73ddf77d9e40a635828

Analysis

max time kernel
147s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:52

Target

Microsoft.DiaSymReader.Native.x86.dll
Size

1.5MB
MD5

787fac94cf265ea23183e9cad64df8f9
SHA1

6ba4d630f2e6185afb794d7d6a560424ecb3f7fc
SHA256

d74b4f27c10491808c97f29fa97aaa2d760a2be04a158007cc3dbba4e491eb02
SHA512

7473217a66467416e5d001cad933c707e7c4cd9801cfc531cc05461e8601b35523d34cdcc44b49a6c66a2a636772d2a674081abac8eae923fcc6a48bf7425e63
SSDEEP

24576:QXQMKUMx72FMOj5zilmLcUegZKkaioxgZSyalRVm0SSOC2aUrl:j72FMWWCJEkatmZSxTmM6l

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4088 wrote to memory of 556	4088	regsvr32.exe	regsvr32.exe
PID 4088 wrote to memory of 556	4088	regsvr32.exe	regsvr32.exe
PID 4088 wrote to memory of 556	4088	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Microsoft.DiaSymReader.Native.x86.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4088

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\Microsoft.DiaSymReader.Native.x86.dll
2⤵
PID:556