3b50dd726ee95656bf7001404d6a33614468eba46488a7159b55d3234c7788d2

Analysis

max time kernel
134s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 12:51

Target

MitigationConfiguration.dll
Size

76KB
MD5

735f325bb89bc7b72ac4699a56a30b26
SHA1

f325a20c28435bb782333a910e19301383473089
SHA256

3b50dd726ee95656bf7001404d6a33614468eba46488a7159b55d3234c7788d2
SHA512

3a178ebc8b360eaae297667fa5dbcef6b72582c4f16cea02da891f75a4a5fe1c8cf680e7d2f8e75d9fa25a7f055f12c495679f77b04c7c26b7458597cbcaeb03
SSDEEP

1536:b8F4F1cT/wZds4QPbp0c8OgFoNBCB5DIJo9bqZ80KXfA3w3cf8urgPkkZR5r/lo8:b8F0cT/wZdspp5vooEDbnTY3w3cf8urT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 4480	2508	regsvr32.exe	83
PID 2508 wrote to memory of 4480	2508	regsvr32.exe	83
PID 2508 wrote to memory of 4480	2508	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\MitigationConfiguration.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\MitigationConfiguration.dll
  2⤵
  PID:4480