b08d0cb28c309840283d82c5c273948cf259dbad0223555d991944745ae7f397

Analysis

max time kernel
132s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 15:41

Target

b08d0cb28c309840283d82c5c273948cf259dbad0223555d991944745ae7f397.dll
Size

5.8MB
MD5

ae0388b431b03362536f421d6613cf45
SHA1

ce1dfc485557b4d946d40368c9e9da5b69005ec4
SHA256

b08d0cb28c309840283d82c5c273948cf259dbad0223555d991944745ae7f397
SHA512

c4cae1b0bc86948ca1290ceac18679ba68b3bc718096075143a272c738e97b1cfbd1c0d53f2c0aaedb8347ff35b279c99bf1858a21fa3a4101c6b19ce494d2cb
SSDEEP

98304:eBSdpXqs+KMD9ap0aCR6P6E6LRbluERHDzQo:eBSv8wgRblzn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 1348	3100	regsvr32.exe	82
PID 3100 wrote to memory of 1348	3100	regsvr32.exe	82
PID 3100 wrote to memory of 1348	3100	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b08d0cb28c309840283d82c5c273948cf259dbad0223555d991944745ae7f397.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b08d0cb28c309840283d82c5c273948cf259dbad0223555d991944745ae7f397.dll
  2⤵
  PID:1348