3f4bf6a900006906fd9ed6b88c65a23f6919c3f840fcf2578dd0a0f45782b999

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 20:55

Target

3f4bf6a900006906fd9ed6b88c65a23f6919c3f840fcf2578dd0a0f45782b999.dll
Size

265KB
MD5

72c59981688b96017ba503d5ef08db8e
SHA1

d84b5ab38c89d35470fa60075abb241fb653d80c
SHA256

3f4bf6a900006906fd9ed6b88c65a23f6919c3f840fcf2578dd0a0f45782b999
SHA512

45d56d9efe367674f62501fd7251f817a584ee41575f4143872ba37ecbb7aa971f698254b57d12bec49c589a87de3d52b2c5d5ec6d8ff299507e7ef865ca4330
SSDEEP

3072:LNRWGiqzgeJZhQR5BQNkToFo03lmq3XO5X9OKTMkAwfjK0dtzrgjnqwiV:PxzgejNksH3kGXO5X9OK7hRDrOv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 4720	1948	regsvr32.exe	82
PID 1948 wrote to memory of 4720	1948	regsvr32.exe	82
PID 1948 wrote to memory of 4720	1948	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3f4bf6a900006906fd9ed6b88c65a23f6919c3f840fcf2578dd0a0f45782b999.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3f4bf6a900006906fd9ed6b88c65a23f6919c3f840fcf2578dd0a0f45782b999.dll
  2⤵
  PID:4720