f4706437df96a7458fc3cde0e64a5c216875f722cb0a8cc685f28d1da375c745

Analysis

max time kernel
134s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 12:42

Target

TtlsCfg.dll
Size

226KB
MD5

3d583b63260ef9b4ccb0879ce2343e53
SHA1

83e2e66768027b2bc3dc9e8cc17ce7ba47d8e37c
SHA256

f4706437df96a7458fc3cde0e64a5c216875f722cb0a8cc685f28d1da375c745
SHA512

bc3f062b5df1af446d2c23a7acf3632f3f5e1fa9e6759f9ba5a0bd0321aac6e83eb4d0da5443a7d93468077596b16fa8eefeaedbc3834caa9ae8d4e69565df78
SSDEEP

3072:GDIXVuw5AVMDYuXQBHSVOvPhEggipFx4Rk8EKrnwIUMdB6MZCsJm5tTU0:GDJAx0uX1O3hESHx4G8frVdz6MZCE0Z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4588	4848	regsvr32.exe	83
PID 4848 wrote to memory of 4588	4848	regsvr32.exe	83
PID 4848 wrote to memory of 4588	4848	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\TtlsCfg.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\TtlsCfg.dll
  2⤵
  PID:4588