b04348b1867a2d8946f1bbcda5cab88c890654a471adc55c0e3bf1ddda5ec71b

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 12:16

Target

b04348b1867a2d8946f1bbcda5cab88c890654a471adc55c0e3bf1ddda5ec71b.dll
Size

44KB
MD5

92e304a724595dd57693c8238a43ba80
SHA1

9e45e43e410c3446bb1a539f2f78a811691f124a
SHA256

b04348b1867a2d8946f1bbcda5cab88c890654a471adc55c0e3bf1ddda5ec71b
SHA512

a487332829a56e4b538bf421baeafb684004d573bc0040db20553f1f88afd6d4c51bb5f71ae2eae1f9b74df816279474eb6edd9a63bc44c7921e2e865f7aa945
SSDEEP

768:oQwCRpkavotlQnPcxRmvSyipAegLa1qH:oQKGkkvS47Lao

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
952	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
952	Rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 892	864	regsvr32.exe	27
PID 864 wrote to memory of 892	864	regsvr32.exe	27
PID 864 wrote to memory of 892	864	regsvr32.exe	27
PID 864 wrote to memory of 892	864	regsvr32.exe	27
PID 864 wrote to memory of 892	864	regsvr32.exe	27
PID 864 wrote to memory of 892	864	regsvr32.exe	27
PID 864 wrote to memory of 892	864	regsvr32.exe	27
PID 892 wrote to memory of 952	892	regsvr32.exe	28
PID 892 wrote to memory of 952	892	regsvr32.exe	28
PID 892 wrote to memory of 952	892	regsvr32.exe	28
PID 892 wrote to memory of 952	892	regsvr32.exe	28
PID 892 wrote to memory of 952	892	regsvr32.exe	28
PID 892 wrote to memory of 952	892	regsvr32.exe	28
PID 892 wrote to memory of 952	892	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b04348b1867a2d8946f1bbcda5cab88c890654a471adc55c0e3bf1ddda5ec71b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b04348b1867a2d8946f1bbcda5cab88c890654a471adc55c0e3bf1ddda5ec71b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\b04348b1867a2d8946f1bbcda5cab88c890654a471adc55c0e3bf1ddda5ec71b.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:952

memory/864-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download
memory/892-56-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download