09e65a661e85c3a3ab0e848809e44f20332b9f46cf5da364c7c8d3992c957f85

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 14:20

Target

AppUtil.dll
Size

1.5MB
MD5

7e489e7300d3177f64db31665a2079e0
SHA1

50b20f0b4e5bb5b35e68dd90a5c465dffd30260e
SHA256

7a426359908ae2b6ca1bc8a2773269a48126c2db23c171bc56a3456da4f0016c
SHA512

0b3b34c0e5e095dfd77d801cd7e85e0431da23bf1c943aacb855a40f5a0d9439d7667718abe654eac17ed474b3c9eb644b90cc8cc215c9adc99b12e29b7907d3
SSDEEP

24576:gbp2vEtmbb6kMjihOgysnGc7EiHhP2C1oPObTSFXhPq2QWv/Ec+M6em:gbpLtmbe7dSvAObTAXhPq2QW3Ec+M6em

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3172 wrote to memory of 2180	3172	regsvr32.exe	regsvr32.exe
PID 3172 wrote to memory of 2180	3172	regsvr32.exe	regsvr32.exe
PID 3172 wrote to memory of 2180	3172	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AppUtil.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\AppUtil.dll
  2⤵
  PID:2180