7d7ee0e33727d9db6fe70aaf56f3e4ecea1a7a01e4880586384e25ab07e3927d

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 16:37

Target

$PROGRAMFILES/$_34_/$_44_.dll
Size

4.0MB
MD5

e56349da176df943885053367da2e539
SHA1

1b279991969dfb1db2b039900503446d0e2cb13f
SHA256

845dd0a0bcbe7b5bd58371c183621ca3bd558ce5798d87e5bb7a56e70300a310
SHA512

70b2633b9afca366c4c2ab5377b9441ad6c23637090599ebe86de6d11d849f1daf5c7c0c6c182c7568654c01a36ba6d32899d36191a42df476b220d12e190537
SSDEEP

49152:KWBQmJdIadQGz+ueYT6zPo7RtwGdSLHaQ2gzVQMrd/yBSaB921QuKHvR:KWBHJdxVCJYT6zPCRtwGd2yBRZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 1172	916	regsvr32.exe	83
PID 916 wrote to memory of 1172	916	regsvr32.exe	83
PID 916 wrote to memory of 1172	916	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\$_34_\$_44_.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\$_34_\$_44_.dll
  2⤵
  PID:1172