cba1aad8560da513a8531369640f71c19c49578e1356265eb17d0375ba1b1a85

Analysis

max time kernel
132s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 11:50

Target

Windows.Networking.Sockets.PushEnabledApplication.dll
Size

61KB
MD5

9610a95d72e258abfc4ec30a5f1b12ca
SHA1

0886c51db503ee79bf4ed6edf8b65758d9c364f8
SHA256

cba1aad8560da513a8531369640f71c19c49578e1356265eb17d0375ba1b1a85
SHA512

9199bf87b35079dfe8cccd58e1fdbb3c568cb6956ebc00665d5523a81ddd3936c5d35f4433d74df4349910210e62231477487b7e2954d18c9e736b814e081662
SSDEEP

768:28C0K1kTluOodkwqlivhD1u7H7fUb2WjUVNKB+GWOrGpQRGkds:2t0GkTlu/sliD2Ib2n6wGWOrGpQIk

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2240	1896	regsvr32.exe	82
PID 1896 wrote to memory of 2240	1896	regsvr32.exe	82
PID 1896 wrote to memory of 2240	1896	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Windows.Networking.Sockets.PushEnabledApplication.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Windows.Networking.Sockets.PushEnabledApplication.dll
  2⤵
  PID:2240