cbd1b43014a55d0a09dae38c4e03bbd9604de63cf6383bcf8a8f8bf5af289b3e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 01:21

Target

17a28f294efe4b437e44a1fa65d7b322.dll
Size

600KB
MD5

17a28f294efe4b437e44a1fa65d7b322
SHA1

cc201e12e7fa664b8e7cd5e92b4f231b38d19756
SHA256

cbd1b43014a55d0a09dae38c4e03bbd9604de63cf6383bcf8a8f8bf5af289b3e
SHA512

749e6159e94ae0bfa5e4e0a1876487fa73aaefa123e6ce1fdf918b6ec9b972c3b77055df4d111fddcad61eae4eeddc0fd04c58d32cf9166f33ec3243775af861
SSDEEP

12288:WiZsxijdRg6NxC349/35+xF3Z4mxx5DqVTVOC+Z:Wikijo6xC3yxOQmXQVTzq

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1052	regsvr32.exe
Token: SeDebugPrivilege	1052	regsvr32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1052	regsvr32.exe
1052	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 1052	2432	regsvr32.exe	84
PID 2432 wrote to memory of 1052	2432	regsvr32.exe	84
PID 2432 wrote to memory of 1052	2432	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\17a28f294efe4b437e44a1fa65d7b322.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\17a28f294efe4b437e44a1fa65d7b322.dll
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1052

memory/1052-0-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/1052-2-0x00000000004FA000-0x00000000004FB000-memory.dmp

Filesize
4KB

Download
memory/1052-1-0x0000000002910000-0x0000000002964000-memory.dmp

Filesize
336KB

Download
memory/1052-4-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/1052-3-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/1052-6-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download