2502a3f8c9a6a8681f9222e93b14e077bf879e3009571c646ee94275bc994d01

Resubmissions

27-10-2022 16:06

25-08-2022 03:54

max time kernel
183s
max time network
198s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-08-2022 03:54

Target

utdh1.dll
Size

760KB
MD5

d94657449f8d8c165ef88fd93e463134
SHA1

eb5cddacd6764098a20ce18a5e1e52f5e603e4ff
SHA256

2502a3f8c9a6a8681f9222e93b14e077bf879e3009571c646ee94275bc994d01
SHA512

659bc86dbd47d9f99c123db7c78d1bac68e4d592eed8f6d2d9ce5289cbf09bf893f0136a67e41e6dc59e1c826f19d34f8ffbaa5089c28592528ead595cca3ddb
SSDEEP

12288:zCZAm0a9L7/7n/zUo2ThEQNvJZAHx137OyyyQTYzzCuatGfWE24rn2k2H824rn2y:wX9v/7/zYdNvnAR13pyyPa+n2F

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1368 wrote to memory of 2012	1368	regsvr32.exe	cmd.exe
PID 1368 wrote to memory of 2012	1368	regsvr32.exe	cmd.exe
PID 1368 wrote to memory of 2012	1368	regsvr32.exe	cmd.exe
PID 1368 wrote to memory of 1412	1368	regsvr32.exe	cmd.exe
PID 1368 wrote to memory of 1412	1368	regsvr32.exe	cmd.exe
PID 1368 wrote to memory of 1412	1368	regsvr32.exe	cmd.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\utdh1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\system32\cmd.exe
cmd /c "echo Commands" >> C:\Users\Admin\AppData\Local\Temp\A4C4.tmp
2⤵
PID:2012

C:\Windows\system32\cmd.exe
cmd /c "dir" >> C:\Users\Admin\AppData\Local\Temp\A4C4.tmp
2⤵
PID:1412

C:\Users\Admin\AppData\Local\Temp\A4C4.tmp
Filesize
11B

MD5
a67f2061c697fd95f6b28d89b953a51f

SHA1
6730b864104f0840fcebf04383d2e3ef7c324a48

SHA256
d4bdd82a900fea52cbd442ce8cae201982392d3533d765bfceb7682bc2d16a79

SHA512
d9cc7c1593967dbcaf358bc9d394426d97baa7bb6ddeed1767b638c85aa814276eaa3609588b720cab3b2a0b3e36d1d3833dab3e75c9c1a92b8315db61a64cbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\A4C4.tmp
Filesize
3KB

MD5
66ddb0369ce434f17a15cfa67ff8de41

SHA1
580359a26f3c2455bc9667c6be2428351364cdb7

SHA256
ea78c19f54a0a891b6f9b8f8ab29e7c9bc2512b5eeabe68ffaaf3d465ac77d79

SHA512
0a96eb7aaff6373039d294bdaadf04d0a3ce8ecaf937b2c875b86d5cafbd6e88e959f6ee48542950bf6170a041f02c829ddb81015eb619cebbb455600f8e2c55

Download Submit
memory/1368-54-0x000007FEFBC71000-0x000007FEFBC73000-memory.dmp

Filesize
8KB

Download
memory/1368-55-0x0000000180000000-0x0000000180012000-memory.dmp

Filesize
72KB

Download
memory/1412-61-0x0000000000000000-mapping.dmp

Download
memory/2012-60-0x0000000000000000-mapping.dmp

Download